CVE-2018-13383

Timeline

Detection, updates, and resolution for this record.

1. May 29, 2019 · Catalog

   Detected

   A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

2. Jan 10, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Jul 10, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

Affected

• cpe fortinet/fortiosversion unspecified
• cpe fortinet/fortiproxyversion unspecified
• cpe fortinet/fortiproxy2.0.0
• vendor Fortinet FortiOS and FortiProxyversion unspecified

Sources

• CISA KEVCVE-2018-13383

  A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.

  cisa.gov
• CVE.orgCVE-2018-13383

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2018-13383

  30-day exploitation probability 33.6%

  first.org
• NIST NVDCVE-2018-13383

  A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to p

  nvd.nist.gov

References

• Mitigation · fortiguard.com
• Vendor Advisory · fortiguard.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov