Veille CVE
CVE-2018-13382
7.5 Élevée Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Fortinet FortiOS and FortiProxy Improper Authorization
Ajoutée le 10/01/2022 · Échéance de correction (agences US) : 10/07/2022
Action requise : Apply updates per vendor instructions.
Description
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.1 Critique | psirt@fortinet.com | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | 7.5 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 2.0 | 5.0 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Faiblesses (CWE)
Références
- https://fortiguard.com/advisory/FG-IR-18-389 Vendor Advisory
- https://www.fortiguard.com/psirt/FG-IR-20-231 Vendor Advisory
- https://fortiguard.com/advisory/FG-IR-18-389 Vendor Advisory
- https://www.fortiguard.com/psirt/FG-IR-20-231 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382 US Government Resource