VDB
CVE-2018-13374
CVE-2018-13374
PUBLISHED
KEV
CVSS 8.800000190734863 HIGH
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.
EPSS 3.37% · 87.6th percentile
Risk Scores
CVSS 3.0
8.800000190734863
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
3.37%
87.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| fortinet | fortiadc | 6.0.0, 6.1.0, 5.4.0 |
| fortinet | fortios | 0 |
Exploit Intelligence
- Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows Security, Sysmon, and IIS log sources to reconstruct the complete attack chain. Identified three exploited CVEs (CVE-2020-0796, CVE-2018-13374, CVE-2018-13379), located a trojanised cmd.exe (github-poc-repo)
- Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows Security, Sysmon, and IIS log sources to reconstruct the complete attack chain. Identified three exploited CVEs (CVE-2020-0796, CVE-2018-13374, CVE-2018-13379), located a trojanised cmd.exe (github-poc-repo)
- Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows Security, Sysmon, and IIS log sources to reconstruct the complete attack chain. Identified three exploited CVEs (CVE-2020-0796, CVE-2018-13374, CVE-2018-13379), located a trojanised cmd.exe (github-poc-repo)
- Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows Security, Sysmon, and IIS log sources to reconstruct the complete attack chain. Identified three exploited CVEs (CVE-2020-0796, CVE-2018-13374, CVE-2018-13379), located a trojanised cmd.exe (github-poc-repo)
- Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows Security, Sysmon, and IIS log sources to reconstruct the complete attack chain. Identified three exploited CVEs (CVE-2020-0796, CVE-2018-13374, CVE-2018-13379), located a trojanised cmd.exe (github-poc-repo)
- Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows Security, Sysmon, and IIS log sources to reconstruct the complete attack chain. Identified three exploited CVEs (CVE-2020-0796, CVE-2018-13374, CVE-2018-13379), located a trojanised cmd.exe (github-poc)
- Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows Security, Sysmon, and IIS log sources to reconstruct the complete attack chain. Identified three exploited CVEs (CVE-2020-0796, CVE-2018-13374, CVE-2018-13379), located a trojanised cmd.exe (github-poc)
- Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows Security, Sysmon, and IIS log sources to reconstruct the complete attack chain. Identified three exploited CVEs (CVE-2020-0796, CVE-2018-13374, CVE-2018-13379), located a trojanised cmd.exe (github-poc)
- Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows Security, Sysmon, and IIS log sources to reconstruct the complete attack chain. Identified three exploited CVEs (CVE-2020-0796, CVE-2018-13374, CVE-2018-13379), located a trojanised cmd.exe (github-poc)
- FortiGate FortiOS < 6.0.3 - LDAP Credential Disclosure - Hardware webapps Exploit (variot)
…and 9 more exploits
Timeline
- Jan 16, 2019 PoC Published
- Jan 22, 2019 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 8, 2022 CISA KEV Added
- Nov 6, 2022 EPSS Score
- Jan 8, 2023 EPSS Score
References
- https://www.fortiguard.com/psirt/FG-IR-21-002 advisory
- https://www.fortiguard.com/psirt/FG-IR-20-049 advisory
- https://www.fortiguard.com/psirt/FG-IR-20-231 advisory
- https://www.fortiguard.com/psirt/FG-IR-21-006 advisory
- https://www.fortiguard.com/psirt/FG-IR-18-157 advisory
- https://www.fortiguard.com/psirt/FG-IR-21-001 advisory
- https://www.fortiguard.com/psirt/FG-IR-20-233 advisory
- https://www.fortiguard.com/psirt/FG-IR-20-147 advisory
- https://www.fortiguard.com/psirt/FG-IR-21-018 advisory
- https://www.fortiguard.com/psirt/FG-IR-20-137 advisory
- https://www.fortiguard.com/psirt/FG-IR-20-120 advisory
- https://www.fortiguard.com/psirt/FG-IR-20-199 advisory
- https://www.fortiguard.com/psirt/FG-IR-21-026 advisory
- https://fortiguard.com/psirt/FG-IR-18-157 advisory
- https://fortiguard.com/psirt/FG-IR-18-121 advisory
- https://fortiguard.com/psirt/FG-IR-18-101 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-13374 advisory
- https://fortiguard.com/advisory/FG-IR-18-157 url
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13374 url