Insufficient Session Expiration in FortiOS SSL-VPN by Fortinet

CVE-2024-50562

What is CVE-2024-50562?

An Insufficient Session Expiration vulnerability in FortiOS SSL-VPN allows attackers possessing a valid session cookie to reauthenticate despite the session being expired or logged out. This poses a risk of unauthorized access, potentially enabling malicious activities that could compromise sensitive data. Affected versions include FortiOS SSL-VPN version 7.6.0, 7.4.6 and below, 7.2.10 and below, as well as all versions of 7.0 and 6.4.

References