Fortigate SSL VPN Arbitrary File reading (CVE-2018-13379)

Description

A directory traversal vulnerability exists on Fortigate SSL VPN. An attacker can craft a request that accesses potentially sensitive information in the Fortigate's filesystem.

Remediation

Upgrade to FortiOS 5.6.8, 6.0.5 or 6.2.0

References

FortiOS system file leak through SSL VPN via specially crafted HTTP resource requests

Infiltrating Corporate Intranet Like NSA

Related Vulnerabilities

Typo3 Restler 1.7.0 Local File Disclosure

IP Blacklist Cloud Arbitrary File Disclosure (3.42)

Path Traversal in Oracle GlassFish server open source edition

Leaflet Maps Marker Pro Multiple Vulnerabilities (1.5.7)

WP Cost Estimation & Payment Forms Builder Directory Traversal (9.659)

Severity

High

Classification

CVE-2018-13379 CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N