Lucene search

FortinetCVE-2018-13383

HistoryMay 29, 2019 - 6:29 p.m.

CVE-2018-13383

2019-05-2918:29:00

CWE-787

fortinet

web.nvd.nist.gov

935

In Wild

fortinet

fortios

fortiproxy

ssl vpn

heap buffer overflow

cve-2018-13383

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

6.8

Confidence

High

EPSS

0.008

Percentile

81.9%

JSON

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

Affected configurations

Nvd

Node

fortinetfortiproxyRange≤1.2.8

fortinetfortiproxyMatch2.0.0

fortinetfortiosRange≤5.2.14

fortinetfortiosRange5.4.0–5.4.12

fortinetfortiosRange5.6.0–5.6.10

fortinetfortiosRange6.0.0–6.0.4

VendorProductVersionCPE
fortinetfortiproxy*cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
fortinetfortiproxy2.0.0cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*
fortinetfortios*cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiproxy	*	cpe:2.3:a:fortinet:fortiproxy::::::::
fortinet	fortiproxy	2.0.0	cpe:2.3:a:fortinet:fortiproxy:2.0.0:::::::*
fortinet	fortios	*	cpe:2.3:o:fortinet:fortios::::::::

CNA Affected

[
  {
    "product": "Fortinet FortiOS and FortiProxy",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier, FortiProxy 2.0.0, 1.2.8 and earlier"
      }
    ]
  }
]