6.7
CVE-2024-27779
- EPSS 0.45%
- Veröffentlicht 18.07.2025 07:58:23
- Zuletzt bearbeitet 22.07.2025 17:07:27
- Quelle psirt@fortinet.com
- CVE-Watchlists
- Unerledigt
An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remote attacker in possession of an admin session cookie to keep using that admin's session even after the admin user was deleted.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fortinet ≫ Fortiisolator Version >= 1.2.0 < 2.4.5
Fortinet ≫ Fortisandbox Version >= 3.2.0 < 4.2.7
Fortinet ≫ Fortisandbox Version >= 4.4.0 < 4.4.5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.45% | 0.64 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| psirt@fortinet.com | 6.7 | 1.2 | 5.5 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
|
CWE-613 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."