{"history":[{"alert":0,"cve":"CVE-2018-13382","id":21703,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.81691, \"percentile\": 0.99649}"},{"alert":0,"cve":"CVE-2018-13382","id":19320,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.81691, \"percentile\": 0.99647}"},{"alert":0,"cve":"CVE-2018-13382","id":17286,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.81691, \"percentile\": 0.99646}"},{"alert":0,"cve":"CVE-2018-13382","id":15349,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.81691, \"percentile\": 0.99646}"},{"alert":0,"cve":"CVE-2018-13382","id":13327,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.81691, \"percentile\": 0.99645}"},{"alert":1,"cve":"CVE-2018-13382","id":12707,"kind":"cna","observed_at":1794003600,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-05T09:00:35.087Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://fortiguard.com/advisory/FG-IR-18-389\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://www.fortiguard.com/psirt/FG-IR-20-231\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2018-13382\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2024-10-23T13:31:11.882776Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2022-01-10\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382\"}, \"type\": \"kev\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-863\", \"description\": \"CWE-863 Incorrect Authorization\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2025-10-21T23:45:35.394Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2022-01-10T00:00:00.000Z\", \"value\": \"CVE-2018-13382 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"Fortinet FortiOS, FortiProxy\", \"vendor\": \"Fortinet\", \"versions\": [{\"status\": \"affected\", \"version\": \"FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8, 5.4.1 to 5.4.10, FortiProxy 2.0.0, 1.2.0 to 1.2.8,  1.1.0 to 1.1.6, 1.0.0 to 1.0.7\"}]}], \"datePublic\": \"2019-05-24T00:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"Improper Access Control\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2021-06-03T10:28:48.000Z\", \"orgId\": \"6abe59d8-c742-4dff-8ce8-9b0ca1073da8\", \"shortName\": \"fortinet\"}, \"references\": [{\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://fortiguard.com/advisory/FG-IR-18-389\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://www.fortiguard.com/psirt/FG-IR-20-231\"}], \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"psirt@fortinet.com\", \"ID\": \"CVE-2018-13382\", \"STATE\": \"PUBLIC\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"Fortinet FortiOS, FortiProxy\", \"version\": {\"version_data\": [{\"version_value\": \"FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8, 5.4.1 to 5.4.10, FortiProxy 2.0.0, 1.2.0 to 1.2.8,  1.1.0 to 1.1.6, 1.0.0 to 1.0.7\"}]}}]}, \"vendor_name\": \"Fortinet\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests\"}]}, \"impact\": {\"cvss\": {\"attackComplexity\": \"Low\", \"attackVector\": \"Network\", \"availabilityImpact\": \"None\", \"baseScore\": 8.9, \"baseSeverity\": \"High\", \"confidentialityImpact\": \"High\", \"integrityImpact\": \"High\", \"privilegesRequired\": \"None\", \"scope\": \"Unchanged\", \"userInteraction\": \"None\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"version\": \"3.1\"}}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"Improper Access Control\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://fortiguard.com/advisory/FG-IR-18-389\", \"refsource\": \"CONFIRM\", \"url\": \"https://fortiguard.com/advisory/FG-IR-18-389\"}, {\"name\": \"https://www.fortiguard.com/psirt/FG-IR-20-231\", \"refsource\": \"CONFIRM\", \"url\": \"https://www.fortiguard.com/psirt/FG-IR-20-231\"}]}}}}, \"cveMetadata\": {\"assignerOrgId\": \"6abe59d8-c742-4dff-8ce8-9b0ca1073da8\", \"assignerShortName\": \"fortinet\", \"cveId\": \"CVE-2018-13382\", \"datePublished\": \"2019-06-04T20:33:53.000Z\", \"dateReserved\": \"2018-07-06T00:00:00.000Z\", \"dateUpdated\": \"2025-10-21T23:45:35.394Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"},{"alert":0,"cve":"CVE-2018-13382","id":11109,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.81691, \"percentile\": 0.99646}"},{"alert":0,"cve":"CVE-2018-13382","id":8855,"kind":"epss","observed_at":1793895600,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.81691, \"percentile\": 0.99645}"},{"alert":0,"cve":"CVE-2018-13382","id":6643,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.81691, \"percentile\": 0.99645}"},{"alert":0,"cve":"CVE-2018-13382","id":4420,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.81691, \"percentile\": 0.99644}"},{"alert":0,"cve":"CVE-2018-13382","id":2202,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.81691, \"percentile\": 0.99643}"},{"alert":1,"cve":"CVE-2018-13382","id":1448,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2018-13382\", \"cwes\": [\"CWE-285\"], \"dateAdded\": \"2022-01-10\", \"dueDate\": \"2022-07-10\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Known\", \"notes\": \"https://nvd.nist.gov/vuln/detail/CVE-2018-13382\", \"product\": \"FortiOS and FortiProxy\", \"requiredAction\": \"Apply updates per vendor instructions.\", \"shortDescription\": \"An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.\", \"vendorProject\": \"Fortinet\", \"vulnerabilityName\": \"Fortinet FortiOS and FortiProxy Improper Authorization\"}"}],"record":{"affected":[{"product":"Fortinet FortiOS, FortiProxy","vendor":"Fortinet","versions":[{"status":"affected","version":"FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8, 5.4.1 to 5.4.10, FortiProxy 2.0.0, 1.2.0 to 1.2.8,  1.1.0 to 1.1.6, 1.0.0 to 1.0.7"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T09:00:35.087Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://fortiguard.com/advisory/FG-IR-18-389"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://www.fortiguard.com/psirt/FG-IR-20-231"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2018-13382","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2024-10-23T13:31:11.882776Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2022-01-10","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382"},"type":"kev"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-10-21T23:45:35.394Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382"}],"timeline":[{"lang":"en","time":"2022-01-10T00:00:00.000Z","value":"CVE-2018-13382 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Fortinet FortiOS, FortiProxy","vendor":"Fortinet","versions":[{"status":"affected","version":"FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8, 5.4.1 to 5.4.10, FortiProxy 2.0.0, 1.2.0 to 1.2.8,  1.1.0 to 1.1.6, 1.0.0 to 1.0.7"}]}],"datePublic":"2019-05-24T00:00:00.000Z","descriptions":[{"lang":"en","value":"An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"description":"Improper Access Control","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2021-06-03T10:28:48.000Z","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","shortName":"fortinet"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://fortiguard.com/advisory/FG-IR-18-389"},{"tags":["x_refsource_CONFIRM"],"url":"https://www.fortiguard.com/psirt/FG-IR-20-231"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@fortinet.com","ID":"CVE-2018-13382","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Fortinet FortiOS, FortiProxy","version":{"version_data":[{"version_value":"FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8, 5.4.1 to 5.4.10, FortiProxy 2.0.0, 1.2.0 to 1.2.8,  1.1.0 to 1.1.6, 1.0.0 to 1.0.7"}]}}]},"vendor_name":"Fortinet"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests"}]},"impact":{"cvss":{"attackComplexity":"Low","attackVector":"Network","availabilityImpact":"None","baseScore":8.9,"baseSeverity":"High","confidentialityImpact":"High","integrityImpact":"High","privilegesRequired":"None","scope":"Unchanged","userInteraction":"None","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Improper Access Control"}]}]},"references":{"reference_data":[{"name":"https://fortiguard.com/advisory/FG-IR-18-389","refsource":"CONFIRM","url":"https://fortiguard.com/advisory/FG-IR-18-389"},{"name":"https://www.fortiguard.com/psirt/FG-IR-20-231","refsource":"CONFIRM","url":"https://www.fortiguard.com/psirt/FG-IR-20-231"}]}}}},"cveMetadata":{"assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","assignerShortName":"fortinet","cveId":"CVE-2018-13382","datePublished":"2019-06-04T20:33:53.000Z","dateReserved":"2018-07-06T00:00:00.000Z","dateUpdated":"2025-10-21T23:45:35.394Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1794003600,"cve":"CVE-2018-13382","description":"An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests","epss":{"date":"2026-11-12","epss":0.81691,"percentile":0.99649},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2018-13382","cwes":["CWE-285"],"dateAdded":"2022-01-10","dueDate":"2022-07-10","forensicTriage":"No","knownRansomwareCampaignUse":"Known","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-13382","product":"FortiOS and FortiProxy","requiredAction":"Apply updates per vendor instructions.","shortDescription":"An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.","vendorProject":"Fortinet","vulnerabilityName":"Fortinet FortiOS and FortiProxy Improper Authorization"},"kev_checked":1794522003,"products":"Fortinet Fortinet FortiOS, FortiProxy","references":["https://fortiguard.com/advisory/FG-IR-18-389","https://www.fortiguard.com/psirt/FG-IR-20-231","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"fortinet","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Fortinet FortiOS and FortiProxy Improper Authorization","updated_at":1794500401,"workarounds":""},"sources":[]}