IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
4.3Media KEV Usada en ransomware

CVE-2018-13374Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

Fortinet Fortinet FortiOS, fortiADC Publicada: (hace 7 años)

Explotación conocida — Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

CISA confirmó el 08.09.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 29.09.2022.

Acción requerida: Apply updates per vendor instructions. https://www.fortiguard.com/psirt/FG-IR-18-157; https://nvd.nist.gov/vuln/detail/CVE-2018-13374

Descripción

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.

Debilidad (CWE): CWE-732

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
fortinet fortiadc 5.4.0 – < 5.4.5
Fortinet Fortinet FortiOS, fortiADC FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4
fortinet fortios < 6.0.3

Referencias y parches

Coincidencias CPE (NVD) (4)
  • cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:* ≥ 5.4.0 < 5.4.5
  • cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:* ≥ 6.0.0 < 6.0.2
  • cpe:2.3:a:fortinet:fortiadc:6.1.0:*:*:*:*:*:*:*
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* < 6.0.3

CVE recientes del mismo producto — Fortinet (all products)

9.1Crítica
CVE-2026-126229
Fortinet FortiManager; Fortinet FortiAnalyzer; Fortinet FortiManager Cloud; Fortinet FortiAnalyzer Cloud

A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all versions, FortiAna…

9.3Crítica
CVE-2026-126262
Fortinet FortiAnalyzer; Fortinet FortiManager

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, Fort…

7.7Alta
CVE-2026-121528
Fortinet FortiOS

A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote and unauthenticated attacker to perform a…

9.0Crítica
CVE-2026-126259
Fortinet FortiOS

A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or aut…

6.3Media
CVE-2026-121527
Fortinet FortiClientEMS

A execution with unnecessary privileges vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.7, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow an authenticated local attacker with admin privileges to gain root shell access…

7.4Alta
CVE-2026-126255
Fortinet FortiOS; Fortinet FortiPAM

A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, For…