CVEvulnerability

CVE-2018-13383

6.5 MEDIUM Known exploited Published 2019-05-29 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Fortinet FortiOS and FortiProxy Out-of-bounds Write — Fortinet FortiOS and FortiProxy

A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.

Added to KEV: 2022-01-10
Remediation due: 2022-07-10
Ransomware use: Known
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2018-13383

Status: Analyzed
Published: 2019-05-29
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1 ([email protected]): 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected]): 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses: CWE-787

Description

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

Affected configurations

• fortinet fortiproxy (< 1.2.9) • fortinet fortiproxy 2.0.0 • fortinet fortios (>= 5.2.0 < 5.2.15) • fortinet fortios (>= 5.4.0 < 5.4.13) • fortinet fortios (>= 5.6.0 < 5.6.11) • fortinet fortios (>= 6.0.0 < 6.0.5)

Weakness · CWE (1)

CWE-787 Out-of-bounds Write weakness

References