CVE Vulnerabilities

CVE-2024-50562

Insufficient Session Expiration

Published: Jun 10, 2025 | Modified: Jul 25, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.

Weakness

According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”

Affected Software

Name Vendor Start Version End Version
Fortisase Fortinet 24.4.60 (including) 24.4.60 (including)
Fortios Fortinet 6.4.0 (including) 7.2.11 (excluding)
Fortios Fortinet 7.4.0 (including) 7.4.8 (excluding)
Fortios Fortinet 7.6.0 (including) 7.6.0 (including)

Potential Mitigations

References