← Back

CVE-2024-50562

nvd nist
Published: Jun 10, 2025Modified: Jun 17, 2026

JSON object

Loading...
4.8
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Exploitability: 2.2 / Impact: 2.5
Source: psirt@fortinet.com (Secondary)

Description

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.

Affected (4)

Fortinet
2 products
Fortios
Fortisase
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortios
From 6.4.0 to 7.2.11
Fortios
From 7.4.0 to 7.4.8
Fortios
Version 7.6.0
Fortisase
Version 24.4.60

Related CWEs

CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (2)

Source: psirt@fortinet.com
Vendor Advisory
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Timeline

No history available yet.