CVEvulnerability
CVE-2024-50562
4.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2025-06-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-613
Description
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.
Affected configurations
• fortinet fortisase 24.4.60
• fortinet fortios (>= 6.4.0 < 7.2.11)
• fortinet fortios (>= 7.4.0 < 7.4.8)
• fortinet fortios 7.6.0
Related
Weakness · not in database (1)
References
- https://fortiguard.fortinet.com/psirt/FG-IR-24-339 Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-864900.html cert-portal.siemens.com