CVEvulnerability
CVE-2020-6644
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-06-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-613
Description
An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks.
Affected configurations
• fortinet fortideceptor (<= 3.0.0)
Related
Weakness · not in database (1)
References
- https://fortiguard.com/advisory/FG-IR-20-006 Vendor Advisory
- https://fortiguard.com/advisory/FG-IR-20-006 Vendor Advisory