Veille CVE
CVE-2018-13383
6.5 Moyenne Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Fortinet FortiOS and FortiProxy Out-of-bounds Write
Ajoutée le 10/01/2022 · Échéance de correction (agences US) : 10/07/2022
Action requise : Apply updates per vendor instructions.
Description
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 4.3 Moyenne | psirt@fortinet.com | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| 3.1 | 6.5 Moyenne | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| 2.0 | 4.3 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Faiblesses (CWE)
Références
- https://fortiguard.com/advisory/FG-IR-18-388 MitigationVendor Advisory
- https://fortiguard.com/advisory/FG-IR-20-229 Vendor Advisory
- https://fortiguard.com/advisory/FG-IR-18-388 MitigationVendor Advisory
- https://fortiguard.com/advisory/FG-IR-20-229 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13383 US Government Resource