CVE-2018-13379criticalunder attackransomwareCWE-22

CVE-2018-13379: critical vulnerability in Fortinet FortiOS, FortiProxy

Published 04 Jun 2019 · Updated 21 Oct 2025

Follow this CVE + Monitor FortiOS + Monitor FortiProxy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 6 threat group(s) use it.

ssvc Actcvss 9.1epss 100%

from disclosure to weapon68 days

Published on NVDJun 4

1st PoC+68d

CISA KEV+883d

Who exploits it — 6

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

RansomwareAgrius🇮🇷 MITRE ATT&CK

APT / StateAPT29🇷🇺 MITRE ATT&CK

APT / StateBRONZE BUTLER🇨🇳 CISA

APT / StateDragonfly🇷🇺 MITRE ATT&CK

APT / StateMagic Hound🇮🇷 MITRE ATT&CK

RansomwarePlay MITRE ATT&CK

Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A flaw in Fortinet FortiOS and FortiProxy SSL VPN portal allows attackers to download sensitive system files without logging in by using specially crafted web requests. This is dangerous because it exposes confidential data that could be used to attack the system further.

Technical detail

Path traversal vulnerability in SSL VPN web portal (CWE-22) affecting FortiOS 6.0.0-6.0.4, 5.6.3-5.6.7, 5.4.6-5.4.12 and FortiProxy 2.0.0, 1.2.0-1.2.8, 1.1.0-1.1.6, 1.0.0-1.0.7. Unauthenticated remote attacker can craft HTTP requests to bypass directory restrictions and read arbitrary system files, resulting in unauthorized information disclosure of potentially sensitive configuration and system data.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

Fortinet · Fortinet FortiOS, FortiProxy

public PoCs found — 30

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Fortinet FortiOS, FortiProxy

In the same product, most dangerous first.

CVE-2018-13382CRITICALCVE-2018-13382EPSS 81.7%KEV CVE-2022-29055HIGHCVE-2022-29055EPSS 1.1%CVE-2021-26092MEDIUMCVE-2021-26092EPSS 1.1%CVE-2021-43206MEDIUMCVE-2021-43206EPSS 0.8%CVE-2021-26110HIGHCVE-2021-26110EPSS 0.3%

References

https://fortiguard.com/advisory/FG-IR-18-384 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13379 https://www.fortiguard.com/psirt/FG-IR-20-233