Detections
Analytics
CVE-2018-13379
critical
Description
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
From the Tenable Blog
CVE-2018-13379, CVE-2019-5591, CVE-2020-12812: Fortinet Vulnerabilities Targeted by APT Actors
Published: 2021-04-08
Threat actors and ransomware groups are actively targeting three legacy Fortinet vulnerabilities. Background On April 2, the Federal Bureau of Investigation (FBI) along with the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint cybersecurity advisory regarding activity involving advanced persistent threat (APT) actors.
CVE-2018-13379, CVE-2019-11510: FortiGate and Pulse Connect Secure Vulnerabilities Exploited In the Wild
Published: 2019-08-27
Attackers are exploiting arbitrary file disclosure vulnerabilities in popular SSL VPNs from Fortinet and PulseSecure.
References
https://thehackernews.com/2026/08/fbi-disrupts-china-linked-qtfy.html
https://www.databreachtoday.com/attackers-target-zero-day-flaw-in-fortinet-security-software-a-31344
https://www.sophos.com/en-us/blog/initial-access-techniques-used-by-iran-based-threat-actors
https://www.theregister.com/2025/06/04/play_ransomware_infects_900_victims/
https://www.securityweek.com/cisa-fbi-warn-of-china-linked-ghost-ransomware-attacks/
https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-050a
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-317a
https://blog.talosintelligence.com/common-ransomware-actor-ttps-playbooks/
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a
https://www.tenable.com/cyber-exposure/tenable-2022-threat-landscape-report
https://www.darkreading.com/vulnerabilities-threats/everything-you-need-to-know-about-lockbit
https://www.tenable.com/cyber-exposure/a-look-inside-the-ransomware-ecosystem
https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-117a
https://www.tenable.com/cyber-exposure/2021-threat-landscape-retrospective
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a
https://cisomag.com/cring-ransomware-targets-unpatched-vulnerabilities-in-fortinet-vpns/
https://www.ic3.gov/Media/News/2021/210402.pdf
https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-296a
https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play
https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell
https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf
https://assets.sentinelone.com/sentinellabs/evol-agrius
https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions
https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf
https://www.tenable.com/blog/frequently-asked-questions-about-iranian-cyber-operations
https://www.tenable.com/blog/aa23-215a-2022s-top-routinely-exploited-vulnerabilities
https://www.tenable.com/blog/hold-the-door-why-organizations-need-to-prioritize-patching-ssl-vpns
https://www.tenable.com/blog/one-year-later-what-can-we-learn-from-zerologon
https://www.tenable.com/blog/how-covid-19-response-is-expanding-the-cyberattack-surface
https://github.com/chengbochuan3/CVE-Network-Device
https://github.com/belky-me/vamp-forticheck
https://github.com/Lanexus/cve-scanner
https://github.com/MohammedAbdulAhadSaud/DotSlash
https://github.com/Instructor-Admin/Multi-threaded-mass-exploiter-CVE-2018-13379-POC
https://github.com/exploitintel/eip-search
https://github.com/1337or420/FortiGate-FortiWeb-Multi-Exploit-Extractor
https://github.com/Justjeff211/conti-ransomware-writeup
https://github.com/SimoesCTT/CTT-enhanced-VMware-vCenter
https://github.com/kh4sh3i/CVE-2018-13379
https://github.com/pondoksiber/Catatan_CVE
https://github.com/Phemz0/UDMQueries
https://github.com/Phemz0/SocPrimeAreTrash
https://github.com/W01fh4cker/Serein
https://github.com/Exploitspacks/CVE-2018-13379-CVE-2020-12812-CVE-2019-5591
https://github.com/nivdolgin/CVE-2018-13379
https://github.com/B1anda0/CVE-2018-13379
https://github.com/Zeop-CyberSec/fortios_vpnssl_traversal_leak
https://github.com/Blazz3/cve2018-13379-nmap-script
https://github.com/0xHunter/FortiOS-Credentials-Disclosure
https://github.com/jpiechowka/at-doom-fortigate
https://github.com/milo2012/CVE-2018-13379
https://www.fortiguard.com/psirt/FG-IR-20-233
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13379