{"id":"CVE-2018-13380","published":"2019-06-04T20:12:06Z","modified":"2024-10-25T14:06:52Z","title":"A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2…","vendor":"Fortinet","product":"Fortinet FortiOS and FortiProxy","tier":"core","eol":null,"affectedVersions":[{"vendor":"Fortinet","product":"Fortinet FortiOS and FortiProxy","versions":["FortiGate 6.0.0 through 6.0.4, 5.6.0 through 5.6.7, 5.4.0 through 5.4.12, 5.2 and earlier and FortiProxy versions 2.0.0, 1.2.8 and earlier"]}],"description":{"text":"A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1.2.8 and below under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.","provenance":"source","from":"CVE.org"},"summary":{"text":"Fortinet FortiOS (versions 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, and 5.2 and below) and FortiProxy (2.0.0, 1.2.8 and below) contain a cross-site scripting flaw in the SSL VPN web portal. An attacker can inject and run unauthorized script code in a victim's browser by crafting the error or message handling parameters, which requires the victim to interact with a malicious link or page and requires no prior authentication or network position beyond reaching the portal.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:33Z"},"cvss":{"score":4.7,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.62474,"percentile":0.99183,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":2,"pulses":[{"name":"University of Alberta Vulns & Exploits -ACTIVE- 09.26.26","url":"https://otx.alienvault.com/pulse/6ab83c469d15fb75aa60af2a","created":"2026-09-26"},{"name":"University of Alberta - Active Exploits in the Wild","url":"https://otx.alienvault.com/pulse/69cf54dc2c334d92d90ad45b","created":"2026-04-03"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://fortiguard.com/advisory/FG-IR-18-383","tags":["x_refsource_CONFIRM"]},{"url":"https://fortiguard.com/advisory/FG-IR-20-230","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-5324","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-5324","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2018-13380","name":"Fortinet FortiOS - Cross-Site Scripting","severity":"medium","path":"http/cves/2018/CVE-2018-13380.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-13380.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2019-06-04","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-13380","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":29.2,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.84,"detail":"percentile 0.9918"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":3.29,"detail":"base score 4.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}