PT-2019-4642 · Fortinet · Fortiproxy+1

Published

2019-05-29

·

Updated

2025-10-24

·

CVE-2018-13383

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions FortiOS versions 5.2.14 and earlier FortiOS versions 5.4.0 through 5.4.12 FortiOS versions 5.6.0 through 5.6.10 FortiOS versions 6.0.0 through 6.0.4 FortiProxy version 1.2.8 and earlier FortiProxy version 2.0.0
Description The issue is related to a heap buffer overflow in the SSL VPN web portal, which can cause the SSL VPN web service to terminate for logged-in users due to a failure to properly handle javascript href data when proxying webpages. This can potentially allow a remote attacker to cause a denial of service. The vulnerability is exploited when an authenticated user visits a specifically crafted proxy-ed webpage, due to a failure to handle javascript href content properly. This only affects SSL VPN web-mode, and SSL VPN tunnel-mode is not impacted.
Recommendations For FortiOS versions 5.2.14 and earlier, update to a version that fixes the heap buffer overflow vulnerability. For FortiOS versions 5.4.0 through 5.4.12, update to a version that fixes the heap buffer overflow vulnerability. For FortiOS versions 5.6.0 through 5.6.10, update to a version that fixes the heap buffer overflow vulnerability. For FortiOS versions 6.0.0 through 6.0.4, update to a version that fixes the heap buffer overflow vulnerability. For FortiProxy version 1.2.8 and earlier, update to a version that fixes the heap buffer overflow vulnerability. For FortiProxy version 2.0.0, update to a version that fixes the heap buffer overflow vulnerability. As a temporary workaround, consider restricting access to the SSL VPN web portal until a patch is available.

Fix

RCE

DoS

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787CWE-119

Related Identifiers

BDU:2020-00808
CVE-2018-13383

Affected Products

Fortios
Fortiproxy