Actively exploited in the wild

Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

Fortinet - FortiOS and FortiADC · Listed in the CISA KEV since 2022-09-08. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2018-13374

MediumCVSS 4.3KEV

Published: 22/01/2019(UTC)Updated: 13/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

38.09%

98th percentile - higher than 98% of all known CVEs

Summary

An improper access control vulnerability in Fortinet FortiOS and FortiADC allows an attacker to obtain LDAP server login credentials configured in FortiGate by pointing a connectivity test to a rogue LDAP server.

Risk Assessment

An attacker could obtain LDAP credentials, potentially leading to unauthorized access to organizational systems and data.

Recommendation

Update FortiOS and FortiADC to versions that fix this vulnerability and ensure LDAP connectivity tests are only performed with trusted servers.

Original NVD description (English source)

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.