CVE-2018-13380

MEDIUM NUCLEI

FortiOS < 6.0.5, 5.6.8, 5.4.13 & FortiProxy < 2.0.1, 1.2.9 XSS via SSL VPN Error Handling

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2018-13380 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1.2.8 and below under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.

Nuclei Templates (1)

Fortinet FortiOS - Cross-Site Scripting
MEDIUMby shelld3v,AaronChen0
Shodan: http.html:"/remote/login" "xxxxxxxx" || http.favicon.hash:945408572 || cpe:"cpe:2.3:o:fortinet:fortios" || port:10443 http.favicon.hash:945408572
FOFA: body="/remote/login" "xxxxxxxx" || icon_hash=945408572

References (2)

Core 2
Core References
Mitigation, Vendor Advisory x_refsource_confirm
https://fortiguard.com/advisory/FG-IR-18-383
Vendor Advisory x_refsource_confirm
https://fortiguard.com/advisory/FG-IR-20-230

Scores

CVSS v3 4.7
EPSS 0.6247
EPSS Percentile 99.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (3)
fortinet/fortios < 5.2
fortinet/fortiproxy 2.0.0
fortinet/fortiproxy < 1.2.8
Published Jun 04, 2019
Tracked Since Feb 18, 2026