VYPR
← All advisories
Medium severity4.3CISA KEVNVD Advisory· Published May 29, 2019· Updated Jun 17, 2026

CVE-2018-13383

CVE-2018-13383

Description

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

Affected products

6
  • Fortinet/Fortiproxy3 versions
    cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*range: <1.2.9
    • cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*
    • (no CPE)range: 2.0.0, 1.2.8 and earlier
  • Fortinet/Fortios2 versions
    cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*range: >=5.2.0,<5.2.15
    • (no CPE)range: 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier
  • Fortinet/Fortinet FortiOS and FortiProxyv5
    Range: FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier, FortiProxy 2.0.0, 1.2.8 and earlier

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.