Actively exploited · Published May 29, 2019 · Assigned by fortinet

CVE-2018-13383

Medium 4.3 Exploited Ransomware

In plain English

A medium-severity out-of-bounds write in Fortinet FortiOS and FortiProxy from Fortinet. Attackers are actively exploiting it in the wild (listed by CISA on January 10, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 32.5% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)32.5%top 1.7% of all CVEs

Exploited in the wildYesCISA KEV since Jan 10, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jul 10, 2022.

Official description

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

Affected products (as reported)

Vendor	Product	Versions
Fortinet	Fortinet FortiOS and FortiProxy	FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier, FortiProxy 2.0.0, 1.2.8 and earlier

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

https://fortiguard.com/advisory/FG-IR-18-388 x_refsource_CONFIRM
https://fortiguard.com/advisory/FG-IR-20-229 x_refsource_CONFIRM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13383 government-resource