CVE-2021-24019

published 2021-10-06

CVE-2021-24019: An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)

Affected

5 ranges

Vendor	Product	Version range	Fixed in
fortinet	forticlient_endpoint_management_server	< 6.2.9	6.2.9
fortinet	forticlient_endpoint_management_server	>= 6.4.0 < 6.4.2	6.4.2
fortinet	forticlientems	—	—
fortinet	forticlientendpointmanagementserver	—	—
fortinet	fortinet_forticlientems	—	—

CWE-613