← Back

CVE-2024-27779

nvd nist
Published: Jul 18, 2025Modified: Jun 17, 2026

JSON object

Loading...
6.7
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Exploitability: 1.2 / Impact: 5.5
Source: psirt@fortinet.com (Secondary)

Description

An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remote attacker in possession of an admin session cookie to keep using that admin's session even after the admin user was deleted.

Affected (3)

Fortinet
2 products
Fortiisolator
Fortisandbox
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Fortiisolator
From 1.2.0 to 2.4.5
Fortinet
Fortisandbox
From 3.2.0 to 4.2.7
Fortisandbox
From 4.4.0 to 4.4.5

Related CWEs

CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.