An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.
Weakness
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fortisase | Fortinet | 24.4.60 (including) | 24.4.60 (including) |
| Fortios | Fortinet | 6.4.0 (including) | 7.2.11 (excluding) |
| Fortios | Fortinet | 7.4.0 (including) | 7.4.8 (excluding) |
| Fortios | Fortinet | 7.6.0 (including) | 7.6.0 (including) |