Insufficient Session Expiration in FortiOS SSL-VPN by Fortinet
CVE-2024-50562

4.4MEDIUM

Key Information:

Vendor

Fortinet
Status
FortiOS
Fortipam
Fortiproxy
Vendor
CVE Published:
10 June 2025

What is CVE-2024-50562?

An Insufficient Session Expiration vulnerability in FortiOS SSL-VPN allows attackers possessing a valid session cookie to reauthenticate despite the session being expired or logged out. This poses a risk of unauthorized access, potentially enabling malicious activities that could compromise sensitive data. Affected versions include FortiOS SSL-VPN version 7.6.0, 7.4.6 and below, 7.2.10 and below, as well as all versions of 7.0 and 6.4.

Affected Version(s)

FortiOS 7.6.0

FortiOS 7.4.6

FortiOS 7.4.0 <= 7.4.4

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-339

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2024-50562 : Insufficient Session Expiration in FortiOS SSL-VPN by Fortinet