Fortinet · FortiOS and FortiADC
CVE-2018-13374
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
What it is
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.
CISA: Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: September 29, 2022
- Added to the CISA list
- September 8, 2022
- Published
- January 22, 2019
- Severity
- Medium 4.3 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 38% in the top 1.4% of all known vulnerabilities
- Weakness
- CWE-732
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Fortinet
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 16, 2026 | Path Traversal | Multiple Products | Medium 5.4 | 1.3% |
| Oct 1, 2026 | Path Traversal | FortiMail | Critical 9.8 | 4.6% |
| Sep 9, 2026 | Heap-based Buffer Overflow | Multiple Products | High 7.4 | 3.7% |
| Jul 27, 2026 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | Medium 5.3 | 29% |
| Jul 16, 2026 | OS Command Injection | FortiSandbox | Critical 9.1 | 76% |
| Jul 16, 2026 | OS Command Injection | FortiSandbox | Critical 9.1 | 93% |
| Apr 13, 2026 | SQL Injection | FortiClient EMS | Critical 9.1 | 98% |
| Apr 6, 2026 | Improper Access Control | FortiClient EMS | Critical 9.1 | 94% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.