CVE-2018-13384

MEDIUM

FortiOS < 6.0.5 - Host Header Redirection via SSL VPN Web Portal

Title source: llm

Description

A Host Header Redirection vulnerability in Fortinet FortiOS all versions below 6.0.5 under SSL VPN web portal allows a remote attacker to potentially poison HTTP cache and subsequently redirect SSL VPN web portal users to arbitrary web domains.

References (1)

Core 1

Core References

Mitigation, Vendor Advisory x_refsource_confirm

https://fortiguard.com/advisory/FG-IR-19-002

Scores

CVSS v3 6.1

EPSS 0.0028

EPSS Percentile 51.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-601

Status published

Products (1)

fortinet/fortios < 6.0.5

Published Jun 04, 2019

Tracked Since Feb 18, 2026