CVE-2020-29012

5.6MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortinet Fortisandbox
Vendor
CVE Published:
8 September 2021

Summary

An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID (via other, hypothetical attacks)

Affected Version(s)

Fortinet FortiSandbox FortiSandbox 3.2.1,

References

https://fortiguard.com/advisory/FG-IR-20-070
x_refsource_CONFIRM

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.