{"id":"CVE-2018-13379","published":"2019-06-04T21:29:00Z","modified":"2026-06-17T01:39:18Z","title":"Fortinet FortiOS SSL VPN Path Traversal Vulnerability","vendor":"Fortinet","product":"FortiOS","tier":"core","eol":null,"description":{"text":"An Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.","provenance":"source","from":"NVD"},"summary":{"text":"Fortinet FortiOS (and FortiProxy) contains a path traversal flaw in the SSL VPN web portal, where pathnames are not properly restricted to the intended directory. An unauthenticated remote attacker can exploit it by sending specially crafted HTTP resource requests to the SSL VPN portal, requiring no authentication or user interaction, to download arbitrary system files.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:08Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99994,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-13379","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-10-02","exploitedFirstSeen":"2019-10-02","ransomware":true,"evidence":[{"url":"https://www.ncsc.gov.uk/news/alert-vpn-vulnerabilities","date":"2019-10-02"},{"url":"https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign.pdf","date":"2020-02-01"},{"url":"https://www.dragos.com/wp-content/uploads/The-ICS-Threat-Landscape.pdf","date":"2020-02-27"},{"url":"https://media.defense.gov/2020/Jul/16/2002457639/-1/-1/0/NCSC_APT29_ADVISORY-QUAD-OFFICIAL-20200709-1810.PDF","date":"2020-07-16"},{"url":"https://www.zdnet.com/article/iranian-hackers-are-selling-access-to-compromised-companies-on-an-underground-forum/","date":"2020-09-01"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa20-296a","date":"2020-10-22"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-283a","date":"2020-10-24"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-296a","date":"2020-12-01"},{"url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf","date":"2020-12-01"},{"url":"https://www.catonetworks.com/blog/50000-fortinet-vpns-breached-via-vulnerability-fixed-18-months-ago-heres-what-you-can-do/","date":"2020-12-03"}],"evidenceTotal":1166,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://fortiguard.com/advisory/FG-IR-18-384","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.fortiguard.com/psirt/FG-IR-20-233","tags":["Vendor Advisory"]},{"url":"https://fortiguard.com/advisory/FG-IR-18-384","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.fortiguard.com/psirt/FG-IR-20-233","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13379","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"exploitation_technique","evidence":[],"comment":"This is a path traversal vulnerability that allows adversary to download system files through specially-crafted HTTP requests.","confidence":"high"},{"id":"T1212","name":"Exploitation for Credential Access","tactics":["credential-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","dataset-annotation"],"basisDetail":"CTID attack_to_cve (Phase 1); AnnoCTR expert entity-linking label (test split)","mappingType":"uncategorized","evidence":[{"reportId":"SRC-336e8bcad5df70884647","quote":"The actor claimed he obtained the credentials through a path traversal vulnerability in Fortinet’s FortiGate secure sockets layer (SSL) VPN web portal (CVE-2018-13379).","start":3771,"end":3939}],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[{"id":"SRC-ce7b9a3cbd89209af483","title":"Exposing POLONIUM activity and infrastructure targeting Israeli organizations","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/","date":"2022-06-02","mentions":[{"quote":"This suggests, but does not definitively prove, that POLONIUM compromised these Fortinet devices by exploiting the CVE-2018-13379 vulnerability to gain access to the compromised organizations.","start":12051,"end":12243}]},{"id":"SRC-f144807c3c05fbc98a1a","title":"Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","date":"2022-05-09","mentions":[{"quote":"FortiGate VPN servers affected by CVE-2018-13379","start":62596,"end":62644}]},{"id":"SRC-336e8bcad5df70884647","title":"Cybercrime underground flush with shipping companies’ credentials","publisher":"Intel 471","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/test/intel471_2021-11-02_shipping-companies-ransomware-credentials.txt","date":"2021-11-02","mentions":[{"quote":"The actor claimed he obtained the credentials through a path traversal vulnerability in Fortinet’s FortiGate secure sockets layer (SSL) VPN web portal (CVE-2018-13379).","start":3771,"end":3939}]},{"id":"SRC-8b6e5f3c2592261e3f88","title":"Advisory further TTPs associated with SVR cyber actors","publisher":"ncsc.gov.uk","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf","date":null,"mentions":[{"quote":"• CVE-2018-13379 FortiGate","start":2593,"end":2619}]},{"id":"SRC-6a1b1e8f3a7b99e55bf0","title":"Advisory: APT29 targets","publisher":"ncsc.gov.uk","url":"https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf","date":null,"mentions":[{"quote":"• CVE-2018-13379 FortiGate [2]","start":3184,"end":3214}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-5323","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-5323","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":47287,"url":"https://www.exploit-db.com/exploits/47287","title":"Fortinet FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure (Metasploit)","type":"webapps","platform":"hardware","date":"2019-08-19","verified":false,"provenance":"source"},{"id":47288,"url":"https://www.exploit-db.com/exploits/47288","title":"Fortinet FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure","type":"webapps","platform":"hardware","date":"2019-08-19","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2019-08-19"},"pocGithub":{"count":13,"skipped":1,"earliest":"2019-08-11","earliestUrl":"https://github.com/milo2012/CVE-2018-13379","repos":[{"name":"milo2012/CVE-2018-13379","url":"https://github.com/milo2012/CVE-2018-13379","stars":253,"created":"2019-08-11"},{"name":"Blazz3/cve2018-13379-nmap-script","url":"https://github.com/Blazz3/cve2018-13379-nmap-script","stars":12,"created":"2019-10-14"},{"name":"Zeop-CyberSec/fortios_vpnssl_traversal_leak","url":"https://github.com/Zeop-CyberSec/fortios_vpnssl_traversal_leak","stars":9,"created":"2020-11-30"},{"name":"B1anda0/CVE-2018-13379","url":"https://github.com/B1anda0/CVE-2018-13379","stars":9,"created":"2020-12-14"},{"name":"0xHunter/FortiOS-Credentials-Disclosure","url":"https://github.com/0xHunter/FortiOS-Credentials-Disclosure","stars":6,"created":"2019-09-24"}]},"metasploit":[{"name":"FortiOS Path Traversal Credential Gatherer","module":"auxiliary/gather/fortios_vpnssl_traversal_creds_leak","type":"auxiliary","disclosureDate":null,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/fortios_vpnssl_traversal_creds_leak.rb"}],"nuclei":[{"id":"CVE-2018-13379","name":"Fortinet FortiOS - Credentials Disclosure","severity":"critical","path":"http/cves/2018/CVE-2018-13379.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-13379.yaml"}],"first":{"date":"2019-08-11","source":"PoC-in-GitHub","url":"https://github.com/milo2012/CVE-2018-13379"},"provenance":"source"},"detections":{"cveRules":[{"title":"Fortinet CVE-2018-13379 Exploitation","id":"a2e97350-4285-43f2-a63f-d0daff291738","level":"critical","status":"test","path":"rules-emerging-threats/2018/Exploits/CVE-2018-13379/web_cve_2018_13379_fortinet_preauth_read_exploit.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/Exploits/CVE-2018-13379/web_cve_2018_13379_fortinet_preauth_read_exploit.yml","techniques":["T1190"]}]},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"related","techniques":["T1212"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2019-06-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-13379","provenance":"source"},{"date":"2019-08-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2019-08-19","url":"https://github.com/milo2012/CVE-2018-13379","provenance":"source"},{"date":"2019-10-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.ncsc.gov.uk/news/alert-vpn-vulnerabilities","provenance":"source"},{"date":"2021-11-02","kind":"report","label":"Named in Intel 471: Cybercrime underground flush with shipping companies’ credentials","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/test/intel471_2021-11-02_shipping-companies-ransomware-credentials.txt","provenance":"machine"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-5323","provenance":"source"},{"date":"2022-05-09","kind":"report","label":"Named in microsoft.com: Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","provenance":"machine"},{"date":"2022-06-02","kind":"report","label":"Named in microsoft.com: Exposing POLONIUM activity and infrastructure targeting Israeli organizations","url":"https://www.microsoft.com/en-us/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/","provenance":"machine"}],"speed":{"daysToPublicExploit":68,"firstExploitFrom":"PoC-in-GitHub","daysToKev":883},"priority":{"score":89.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2585 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":10.0,"detail":"5 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 Exploit-DB entries; 13 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-fortinet-fortios-cwe-22"}}