Insufficient Session Expiration and Incorrect Authorization in Fortinet Product

CVE-2024-33507

What is CVE-2024-33507?

A security vulnerability in FortiIsolator allows an unauthenticated remote attacker to deauthenticate logged-in administrators by exploiting an insufficient session expiration issue via crafted cookies. Additionally, a remote authenticated attacker with read-only privileges can gain write access through a similar method, effectively compromising the system's integrity. This vulnerability impacts multiple versions of FortiIsolator, necessitating urgent remediation to protect against potential exploitation.

References