CVE-2018-13374

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.

Affected

Fortinet · Fortinet FortiOS, fortiADC

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0 NVD

4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

EPSS

38.09% chance of exploitation in the next 30 days, 99th percentile

CISA KEV

added 2022-09-08, used in ransomware campaigns

Published

2019-01-22

Updated

2026-10-01

Proof-of-concept exploits (1)

• juliourena/plaintext179★ · 2026-05-26

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/46171

Security advisories

• https://fortiguard.com/advisory/FG-IR-18-157

References

• CVE Record
• NVD entry

Related

• CVE-2019-19470
• CVE-2025-11851
• CVE-2025-11852