An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
References
| Link | Resource |
|---|---|
| https://fortiguard.com/advisory/FG-IR-18-384 | Mitigation Vendor Advisory |
| https://www.fortiguard.com/psirt/FG-IR-20-233 | Vendor Advisory |
| https://fortiguard.com/advisory/FG-IR-18-384 | Mitigation Vendor Advisory |
| https://www.fortiguard.com/psirt/FG-IR-20-233 | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13379 | US Government Resource |
Configurations
Configuration 1 (hide)
|
History
24 Oct 2025, 12:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13379 - US Government Resource |
22 Oct 2025, 00:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Oct 2025, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Oct 2025, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2019-06-04 21:29
Updated : 2025-10-24 12:53
NVD link : CVE-2018-13379
Mitre link : CVE-2018-13379
CVE.ORG link : CVE-2018-13379
JSON object : View
Products Affected
fortinet
- fortios
- fortiproxy
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')