CVE-2018-13383

A heap buffer overflow in Fortinet FortiOS all versions below 6.0.5 in the SSL VPN web portal may...

4.3 MediumIn KEV

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

32.5%Up 31.8 points since Apr 14, 2021

What each source reports

CVE List Score used 4.3

Record: CVE-2018-13383
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2018-5327 4.3

Record: EUVD-2018-5327
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-cjc8-2cq5-7jq7 6.5

A heap buffer overflow in Fortinet FortiOS all versions below 6.0.5 in the SSL VPN web portal may...

A heap buffer overflow in Fortinet FortiOS all versions below 6.0.5 in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

Record: GHSA-cjc8-2cq5-7jq7
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-119, CWE-787
Updated: 2026-11-02

CISA KEV No score

Fortinet FortiOS and FortiProxy Out-of-bounds Write

A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.

Record: CVE-2018-13383
Weakness: CWE-787
Updated: 2026-11-02

NVD 4.3

Record: CVE-2018-13383
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-787
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-13383 is a medium vulnerability (CVSS 4.3) in Fortinet Fortios, published May 29, 2019. CISA lists it as known to be exploited, since January 10, 2022. EUVD reports exploitation since January 10, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 32.5%, the 98th percentile. No source names a fixed version.