{"basis":"claimed","id":"CVE-2018-13379","name":"Fortinet FortiOS SSL VPN Path Traversal Vulnerability","vendorProject":"Fortinet","product":"FortiOS","publishedAt":"2019-06-04","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true},"epss":{"score":0.99999,"percentile":0.99994,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"no_history","firstOn":null,"daysToRule":null},"aws":{"status":"no_history","firstOn":null,"daysToRule":null},"azure":{"status":"rule","firstOn":null,"daysToRule":null},"google":{"status":"no_history","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"no_history","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"no_history","firstOn":null,"daysToRule":null}},"title":null,"description":"An Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.","cwes":["CWE-22"],"vendors":[{"vendor":"cloudflare","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"rule","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[{"id":"e3e049f4872f55c0988c69dcf067deeeb82bca100a0781b987150aee76c224a9","cve_id":"CVE-2018-13379","vendor":"azure","product":"Front Door WAF (DRS)","rule_id":"99001008","rule_name":"Attempted Fortinet path traversal CVE-2018-13379","change":"listed","default_action":null,"published_on":null,"source_url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-drs","source_title":"Front Door WAF (DRS) rule groups and rules","excerpt":"Rule 99001008: Critical - 5 · 2 · Attempted Fortinet path traversal CVE-2018-13379","first_seen_at":"2026-11-02T21:00:19.031Z"},{"id":"35d21f06d510153994f780b39cc29bda9d76f27585fb3e8bb9728a864c29cd4d","cve_id":"CVE-2018-13379","vendor":"azure","product":"Application Gateway WAF (DRS/CRS)","rule_id":"99001008","rule_name":"Attempted Fortinet path traversal CVE-2018-13379","change":"listed","default_action":null,"published_on":null,"source_url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules","source_title":"Application Gateway WAF (DRS/CRS) rule groups and rules","excerpt":"Rule 99001008: Critical - 5 · 2 · Attempted Fortinet path traversal CVE-2018-13379","first_seen_at":"2026-11-02T21:00:19.183Z"}]},{"vendor":"google","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-03T02:17:41.897Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"partial"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"blocked","templateId":"CVE-2018-13379","templatePath":"http/cves/2018/CVE-2018-13379.yaml","requests":1,"blockedRequests":1,"rules":["930100","930110"],"note":"","requestDetail":[{"method":"GET","path":"/remote/fgt_lang?…","status":403,"blocked":true,"rules":["930100","930110"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"blocked","templateId":"CVE-2018-13379","templatePath":"http/cves/2018/CVE-2018-13379.yaml","requests":1,"blockedRequests":1,"rules":["930100","930110"],"note":"","requestDetail":[{"method":"GET","path":"/remote/fgt_lang?…","status":403,"blocked":true,"rules":["930100","930110"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}