ZeroDay Findings
Sign inSign up

Findings

CVE-2018-13374

Fortinet FortiOS and FortiADC Improper Access Control Vulnerability

Published Jan 22, 2019 · updated Oct 1, 2026 · fortinet fortiadc

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 22, 2019 · Catalog

    Detected

    A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.

  2. Sep 8, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Sep 29, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Oct 1, 2026 · Catalog

    Updated

    A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.

Required action

Apply updates per vendor instructions.

CISA due date Sep 29, 2022

Affected

  • cpe fortinet/fortiadcversion unspecified
  • cpe fortinet/fortiadc6.1.0
  • cpe fortinet/fortiosversion unspecified
  • vendor Fortinet FortiOS and FortiADCversion unspecified

Sources

  • CISA KEVCVE-2018-13374

    Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.

    cisa.gov
  • CVE.orgCVE-2018-13374

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2018-13374

    30-day exploitation probability 38.1%

    first.org
  • Exploit Database46171

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2018-13374

    A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server in

    nvd.nist.gov

References

CVE-2018-13374 · ZeroDay Findings