CVE-2018-13379 kev+ ransomware in the critical feed json
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.…
published 2019-06-04 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-5323
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Exploited
- added 2021-11-03, used in ransomware
- epss
- 100.0%
- EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 3
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
Patch / fix
cisa required action Apply updates per vendor instructions.
- fortinet fortiproxy 1.2.9
- fortinet fortios 5.4.13, 5.6.8, 6.0.5
Timeline
- Published
- First public exploit (EDB-47288)
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 5 y ago
- Patch by
- 2022-05-03 (4 y ago)
- Ransomware
- Known to be used in ransomware campaigns
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Fortinet, FortiOS
- CISA name
- Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Ransomware
Groups reported to have exploited it in intrusions.
- Conti ransomware gang
- LockBit ransomware gang
- PLAY ransomware gang
- REvil ransomware gang
- Ghost/Cring ransomware gang
reported by tenable.comcisa.govcisa.govtrendmicro.comcisa.gov
Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0
ATT&CK techniques
How it is exploited and what it leads to, in MITRE ATT&CK terms.
- T1190 Exploit Public-Facing Application exploitation
kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
100.00% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/gather/fortios_vpnssl_traversal_creds_leak FortiOS Path Traversal Credential Gatherer metasploit auxiliary, normal rank
- EDB-47288 Fortinet FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure webapps, 2019-08-19
- EDB-47287 Fortinet FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure (Metasploit) webapps, 2019-08-19
- Nuclei template Fortinet FortiOS - Credentials Disclosure nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Fortinet Fortinet FortiOS, FortiProxy
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
- Technology feeds
References
-
fortiguard.com
/advisory/FG-IR-18-384
mitigation, vendor-advisory
-
fortiguard.com
/psirt/FG-IR-20-233
vendor-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13379
government-resource, us-government-resource
Sources
- CVE List CVE-2018-13379
- NVD CVE-2018-13379
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.