← Back

CVE-2025-25252

nvd nist
Published: Oct 14, 2025Modified: Oct 15, 2025

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Exploitability: 3.9 / Impact: 2.5
Source: NVD

Description

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record.

Affected (4)

Products: Fortinet: Fortios
Fortinet
1 product
Fortios
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortios
From 6.4.0 to 7.0.17
Fortios
From 7.2.0 to 7.2.11
Fortios
From 7.4.0 to 7.4.7
Fortios
From 7.6.0 to 7.6.3

Related CWEs

CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.