CVE-2018-133799.1Critical
Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Fortinet · FortiOS
Exploited in the wild · in CISA KEV since 3 Nov 2021Known ransomware use
99.9%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
9.1CriticalCVSS 3.1
LowMediumHighCrit.
Federal deadline
CISA KEV · added 3 Nov · catalogue entry
Passed 1640 days ago
DescriptionNVD
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
CISA required action
Apply updates per vendor instructions.
Coverage1 article · 1 outlet
First in our coverage: SecurityWeek, 15 Sep.
- Attackers Exploited Fortinet and F5 Flaws to Target Thai ISP 3BBSecurityWeek · first in our coverage
New articles also arrive in the RSS feed.