CVE-2018-13380: Fortinet FortiOS and FortiProxy SSL VPN portal reflected XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityCVSS 6.1 medium with required user interaction, but the high EPSS percentile and internet-facing SSL VPN portal raise the practical risk.

What it is

FortiOS (6.0.0-6.0.4, 5.6.0-5.6.7, 5.4.0-5.4.12, 5.2 and below) and FortiProxy (2.0.0, 1.2.8 and below) fail to properly neutralize input in the SSL VPN web portal's error and message handling parameters, allowing script injection. Because the portal is the entry point remote users authenticate through, a successful attack can run script in the context of a victim's authenticated session.

Impact

An attacker can execute arbitrary script in a victim's browser within the SSL VPN portal origin, enabling session theft, credential capture, or actions performed as the logged-in user. The CVSS scope change (S:C) reflects that the impact can extend beyond the vulnerable component.

Attack surface

Reached over the network via the SSL VPN web portal; the CVSS vector shows no privileges required (PR:N) but user interaction is required (UI:R), meaning a victim must load a crafted link or page. No authentication is needed to deliver the payload, though the victim is typically an authenticated portal user.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware association is recorded in this data; EPSS is high at 0.62474 (99.1st percentile), indicating elevated predicted exploitation activity. References are vendor advisories only, with no exploit-tagged sources.

What to do

• Upgrade FortiOS and FortiProxy to vendor-fixed versions per Fortinet advisories FG-IR-18-383 and FG-IR-20-230.
• If immediate upgrade is not possible, apply the mitigations described in the vendor advisory and restrict SSL VPN portal exposure to trusted networks.
• Enforce MFA and short session lifetimes on SSL VPN to limit the value of a stolen session.
• Deploy a WAF or input-filtering rule to block script payloads in portal error and message parameters.
• Review SSL VPN portal access logs for suspicious parameter values and unexpected client behavior.

Detection

• Search web/proxy logs for script tags, event handlers, or encoded script sequences in SSL VPN portal error and message query parameters.
• Monitor for anomalous SSL VPN portal requests containing reflected parameter values returned in responses.
• Alert on unusual post-authentication portal activity from a single session, such as rapid configuration or credential-related actions.
• Correlate portal access with outbound requests to unfamiliar domains that could indicate script exfiltration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.