CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HCVE-2018-13383
Medium (6.5) in Fortinet FortiOS and FortiProxy. In CISA KEV since 2022-01-10, with known ransomware use. EPSS 32% chance of exploitation in the next 30 days.
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.
Severity
- EPSS
- 32% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2022-01-10, due 2022-07-10, known ransomware use
- CWE
- CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fortinet:fortios
- fortinet:fortiproxy