Security readout for executives and security teams
Plain-English summary
FortiSIEM 5.2.0 and earlier can expose the configured LDAP server password in plaintext within HTML source code. That password may protect directory access, so the business risk depends on who can reach the affected FortiSIEM interface and what privileges the LDAP account has.
Executive priority
Treat this as a credential exposure issue. Prioritize environments where FortiSIEM is reachable beyond a small admin group or where the LDAP account has broad directory privileges.
Technical view
The CVE describes an information disclosure issue in Fortinet FortiSIEM 5.2.0 and below where the LDAP server plaintext password is exposed via HTML source code. The source bundle provides no CVSS score, CWE, detailed prerequisites, fixed version, or exploit evidence.
Likely exposure
Organizations running Fortinet FortiSIEM 5.2.0 or earlier are potentially exposed, especially if the relevant interface is reachable by broad internal users, administrators, or any untrusted network path.
Exploitation context
The provided sources do not state active exploitation, and the CVE is not marked KEV. The practical risk is credential exposure from authorized or reachable interface access, not confirmed public exploitation.
Researcher notes
Evidence is limited to the CVE description and Fortinet advisory reference. No CVSS, CWE, exploit status, affected build range beyond 5.2.0 and below, or explicit fixed version is included in the supplied bundle.
Mitigation direction
- Identify all FortiSIEM deployments and confirm exact versions.
- Review Fortinet advisory FG-IR-18-382 for vendor upgrade or workaround guidance.
- Restrict FortiSIEM management access to trusted administrative networks.
- Rotate the LDAP password after remediation if exposure is plausible.
- Review LDAP account privileges and reduce them where possible.
Validation and detection
- Confirm whether any FortiSIEM instance runs version 5.2.0 or earlier.
- Verify management interfaces are not exposed to untrusted networks.
- Use authorized testing to confirm LDAP passwords are not rendered in HTML source.
- Check LDAP logs for unusual use of the FortiSIEM service account.
- Document remediation status against Fortinet advisory guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-13378 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://fortiguard.com/advisory/FG-IR-18-382CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.