CVE-2018-13374

Katalog CVE

CVSS 4.3 · Medium KEV · sudah dieksploitasi Dipakai ransomware EPSS 38,1%

Kerentanan Incorrect Permission Assignment for Critical Resource pada fortinet fortiadc, fortinet fortios. Skor CVSS 3.1 4.3 (Medium) menurut NVD. Masuk katalog KEV CISA pada 8 September 2022, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.

Rincian

Terbit di NVD

22 Januari 2019

Terakhir diubah

1 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

38,1% peluang dieksploitasi; lebih tinggi dari 98,5% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

Masuk KEV

8 September 2022

Tenggat CISA

29 September 2022 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://fortiguard.com/advisory/FG-IR-18-157 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13374 pemerintah AS