CVE-2018-13382
Fortinet FortiOS and FortiProxy Improper Authorization
Description
CVE-2018-13382 is a critical-severity improper authorization vulnerability in Fortinet FortiOS and FortiProxy. The vulnerability exists in the SSL VPN web portal, where an unauthenticated attacker can modify the password of an SSL VPN web portal user by sending specially crafted HTTP requests. This improper authorization flaw in FortiOS and FortiProxy effectively allows credential bypass, enabling attackers to take over VPN user accounts without any prior authentication. CISA has added CVE-2018-13382 to its Known Exploited Vulnerabilities catalog, and it is known to be leveraged in ransomware campaigns. With an EPSS score of 85.41% (99.36th percentile), this Fortinet vulnerability has a very high probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiproxy | < 1.2.9; 2.0.0 |
| fortinet | fortios | >= 5.4.1, < 5.4.11; >= 5.6.0, < 5.6.9; >= 6.0.0, < 6.0.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://fortiguard.com/advisory/FG-IR-18-389(Vendor Advisory)
- https://www.fortiguard.com/psirt/FG-IR-20-231(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382(US Government Resource)
Weakness Type
CWE-863: Incorrect Authorization
In the context of CVE-2018-13382, the Fortinet FortiOS and FortiProxy SSL VPN web portal performs an authorization check when processing password modification requests, but the check is implemented incorrectly. This allows unauthenticated attackers to bypass the authorization mechanism and modify passwords of SSL VPN users through specially crafted HTTP requests, effectively circumventing the intended access controls.
Learn more: CWE-863 — Incorrect Authorization
Impact Analysis
CVE-2018-13382 carries a CVSS 3.1 score of 9.1 (CRITICAL), reflecting a severe security threat to organizations using Fortinet SSL VPN. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction — making it trivially exploitable by remote attackers. Confidentiality (High): attackers can gain unauthorized access to VPN user accounts and the internal resources protected behind the VPN. Integrity (High): attackers can modify user passwords, locking out legitimate users and establishing persistent unauthorized access. The EPSS score of 85.41% (99.36th percentile) confirms a very high likelihood of active exploitation, and CISA has flagged this vulnerability as being used in ransomware campaigns, significantly amplifying the risk to enterprise networks.
Exploit Maturity
CVE-2018-13382 has a mature exploit landscape with confirmed active exploitation. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-07-10, and it is confirmed to be leveraged in ransomware campaigns. The EPSS score of 85.41% (99.36th percentile) indicates very high exploitation activity. CVE-2018-13382 is commonly exploited alongside CVE-2018-13379 (FortiOS path traversal for credential theft) and CVE-2018-13383 (FortiOS heap buffer overflow), forming a chain that enables initial access, credential modification, and further exploitation of Fortinet VPN infrastructure. Federal agencies were required to remediate this vulnerability by 2022-07-10 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade FortiOS to version 5.4.11+, 5.6.9+, or 6.0.5+ and FortiProxy to version 1.2.9+ to address this improper authorization vulnerability.
- Verify all FortiOS and FortiProxy instances across the organization, including FortiOS versions 5.4.1 through 5.4.10, 5.6.0 through 5.6.8, 6.0.0 through 6.0.4, and FortiProxy versions 1.0.0 through 1.0.7, 1.1.0 through 1.1.6, 1.2.0 through 1.2.8, and 2.0.0, and ensure all are updated to patched versions.
- Reset all SSL VPN user passwords after patching, as existing credentials may have been compromised through exploitation of the authorization bypass. Enforce multi-factor authentication (MFA) for all VPN connections.
- Review VPN access logs for suspicious password modification attempts, unauthorized login activity, and unusual connection patterns that may indicate prior exploitation. Correlate with indicators of compromise associated with known ransomware campaigns targeting Fortinet devices.
- Implement defense-in-depth by restricting SSL VPN portal access to trusted IP ranges, enabling logging of all authentication events, and deploying intrusion detection rules specifically monitoring for CVE-2018-13382 exploitation patterns.
Technical Details
CVE-2018-13382 is caused by CWE-863 (Incorrect Authorization) in the Fortinet FortiOS and FortiProxy SSL VPN web portal. The authorization check that should prevent unauthenticated users from modifying passwords is implemented incorrectly, allowing attackers to bypass it with specially crafted HTTP requests. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N confirms the vulnerability is network-accessible with low complexity and requires neither authentication nor user interaction, while the absence of availability impact indicates the attack does not crash the service. The flaw affects FortiOS versions 5.4.1 through 5.4.10, 5.6.0 through 5.6.8, and 6.0.0 through 6.0.4, as well as FortiProxy versions up to 1.2.8 and 2.0.0. The vulnerability is particularly dangerous because SSL VPN portals are by design exposed to the internet, providing a direct attack surface for unauthenticated remote attackers seeking to compromise enterprise VPN credentials.
Frequently Asked Questions
Is CVE-2018-13382 being actively exploited?
Yes. CVE-2018-13382 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. It is also known to be leveraged in ransomware campaigns. The EPSS score of 85.41% (99.36th percentile) indicates a very high probability of exploitation.
What products are affected by CVE-2018-13382?
CVE-2018-13382 affects Fortinet FortiOS versions 5.4.1 through 5.4.10, 5.6.0 through 5.6.8, and 6.0.0 through 6.0.4, as well as FortiProxy versions 1.0.0 through 1.0.7, 1.1.0 through 1.1.6, 1.2.0 through 1.2.8, and 2.0.0. All affected versions contain the improper authorization flaw in the SSL VPN web portal.
How do I fix CVE-2018-13382?
Upgrade FortiOS to version 5.4.11 or later, 5.6.9 or later, or 6.0.5 or later, and upgrade FortiProxy to version 1.2.9 or later. After patching, reset all SSL VPN user passwords and enable multi-factor authentication for VPN access.
How severe is CVE-2018-13382?
CVE-2018-13382 has a CVSS 3.1 score of 9.1 (CRITICAL). It is remotely exploitable without authentication, requires no user interaction, and is confirmed to be used in ransomware campaigns. Its EPSS score places it in the 99.36th percentile for exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.