|
|
|||
| Rule General Information |
|---|
| Release Date: | 2020-02-19 | |
| Rule Name: | Fortinet FortiOS SSL VPN Directory Traversal Vulnerability (CVE-2018-13379) | |
| Severity: | ||
| CVE ID: | ||
| Rule Protection Details |
|---|
| Description: | An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests. | |
| Impact: | An attacker can abtain sensitive information of the target victim, and do malicious actions to gain profits using the information. | |
| Affected OS: | Windows, Linux, Network Device, Others | |
| Reference: | SecurityFocusBID:108693 http://packetstormsecurity.com/files/154146/FortiOS-5.6.7-6.0.4-Credential-Disclosure.html http://packetstormsecurity.com/files/154147/FortiOS-5.6.7-6.0.4-Credential-Disclosure.html https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/ |
|
| Solutions |
|---|
| Refer to the announcement or patch by the vendor: https://fortiguard.com/psirt/FG-IR-18-384 |