A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fortios | Fortinet | 7.0.0 (including) | 7.0.14 (excluding) |
| Fortios | Fortinet | 7.2.0 (including) | 7.2.8 (excluding) |
| Fortios | Fortinet | 7.4.0 (including) | 7.4.4 (excluding) |
Such a scenario is commonly observed when: