CVE-2018-13379 Fortinet FortiOS
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
- CVSS
- not scored
On CISA’s exploited list
Fortinet FortiOS SSL VPN Path Traversal Vulnerability
- Added
- 2021-11-03
- Federal patch deadline
- 2022-05-03
- Ransomware use
- known
Actors known to use it (MITRE ATT&CK)
- Magic HoundIran · TA453, COBALT ILLUSION, Charming Kitten · 58 techniques
- DragonflyRussia · TEMP.Isotope, DYMALLOY, Berserk Bear · 48 techniques
- APT29Russia · IRON RITUAL, IRON HEMLOCK, NobleBaron · 47 techniques
- Play22 techniques
- AgriusIran · Pink Sandstorm, AMERICIUM, Agonizing Serpens · 20 techniques