KEVIntel
Back to KEVs
4.3
CVSS
Medium

CVE-2018-13374

PUBLISHED

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the...

Exploited in the wild Used in malware Remote Low complexity No user interaction
Vendor
Fortinet
Product
Fortinet FortiOS, fortiADC
Published
Jan 22, 2019
EPSS
—

Description

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.

ios cisa malware ransomware edge nessus_scanner

CVSS scores

CVSS v3.1 4.3 Medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitation status

Exploited in the wild

Recorded 2022-09-08 00:00:00 UTC · Source

Used in malware

Recorded 2022-09-08 00:00:00 UTC · Source

SSVC decision points

Exploitation
active
Automatable
No
Technical impact
partial

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CISA Sep 08, 2022

Scanner integrations

Scanner Reference Detected
Nessus https://www.tenable.com/plugins/nessus/209853 Jun 02, 2025

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Exploit Used in Malware

  • Added to KEVIntel

  • Detected by Nessus