PT-2024-5820 · Fortinet · Fortiswitchmanager+3

Published

2024-08-13

·

Updated

2024-08-22

·

CVE-2022-45862

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions FortiOS versions 7.2.5 and below, 7.0 all versions, 6.4 all versions FortiProxy versions 7.2 all versions, 7.0 all versions FortiPAM versions 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions FortiSwitchManager versions 7.2.1 and below, 7.0 all versions
Description The issue is related to an insufficient session expiration vulnerability. This vulnerability may allow a remote attacker to gain unauthorized access to the device by reusing web sessions after GUI logout, provided they have acquired the required credentials.
Recommendations For FortiOS versions 7.2.5 and below, 7.0 all versions, 6.4 all versions, update to a version that includes a fix for the session expiration issue. For FortiProxy versions 7.2 all versions, 7.0 all versions, update to a version that includes a fix for the session expiration issue. For FortiPAM versions 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions, update to a version that includes a fix for the session expiration issue. For FortiSwitchManager versions 7.2.1 and below, 7.0 all versions, update to a version that includes a fix for the session expiration issue. As a temporary workaround, consider restricting access to the GUI to minimize the risk of exploitation.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BDU:2024-06565
CVE-2022-45862

Affected Products

Fortios
Fortipam
Fortiproxy
Fortiswitchmanager