CVE-2018-13374

MediumCVSS 4.3/10Known exploited (CISA KEV)Last modified Oct 1, 2026

Description

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
Fortinet	Fortinet FortiOS, fortiADC	FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4

References

https://fortiguard.com/advisory/FG-IR-18-157Vendor Advisory
https://fortiguard.com/advisory/FG-IR-18-157Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13374US Government Resource

Timeline

Published: Jan 22, 2019
Last modified: Oct 1, 2026
Added to CISA KEV: Sep 8, 2022
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-133756.1An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an CVE-2018-133767.5An uninitialized memory buffer leak exists in Fortinet FortiOS 5.6.1 to 5.6.3, 5.4.6 to 5.4.7, 5.2 all versions under web proxy's disclaimer CVE-2018-133787.2An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HT CVE-2018-133799.8An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4 CVE-2018-13385.5A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.CVE-2018-133806.1A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet F CVE-2018-133817.5A buffer overflow vulnerability in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.7, 5.4 and earlier versions and FortiProxy 2.0.0,CVE-2018-133827.5An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 t CVE-2018-133836.5A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProx CVE-2018-133846.1A Host Header Redirection vulnerability in Fortinet FortiOS all versions below 6.0.5 under SSL VPN web portal allows a remote attacker to po CVE-2018-133859.8There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission t CVE-2018-133868.1There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. An attacker with permission