medium4.8Public exploit code
CVE-2024-50562
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all version…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- FortiOS SSL-VPN 7.4.4 - Insufficient Session Expiration & Cookie Reuse2025-06-20 · remote · multiple
Impact
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fortinet | Fortisase | Version 24.4.60 |
| Fortinet | Fortios | from 6.4.0 before 7.2.11 from 7.4.0 before 7.4.8 Version 7.6.0 |