CVE-2024-50562
published 2025-06-10CVE-2024-50562: An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all…
medium4.8CVSS 3.1
AVNACHPRNUINSUCLILAN
EXPLOIT
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortios | — | — |
| fortinet | fortios | — | — |
| fortinet | fortios | — | — |
| fortinet | fortios | >= 6.4.0 < 7.2.11 | 7.2.11 |
| fortinet | fortios | 6.4.0 – 6.4.16 | — |
| fortinet | fortios | 7.0.0 – 7.0.17 | — |
| fortinet | fortios | 7.2.0 – 7.2.10 | — |
| fortinet | fortios | >= 7.4.0 < 7.4.8 | 7.4.8 |
| fortinet | fortios | 7.4.0 – 7.4.4 | — |
| fortinet | fortipam | — | — |
| fortinet | fortipam | — | — |
| fortinet | fortipam | 1.0.0 – 1.0.3 | — |
| fortinet | fortipam | 1.1.0 – 1.1.2 | — |
| fortinet | fortipam | 1.4.0 – 1.4.1 | — |
| fortinet | fortiproxy | — | — |
| fortinet | fortiproxy | 2.0.0 – 2.0.14 | — |
| fortinet | fortiproxy | 7.0.0 – 7.0.20 | — |
| fortinet | fortiproxy | 7.2.0 – 7.2.14 | — |
| fortinet | fortiproxy | 7.4.0 – 7.4.5 | — |
| fortinet | fortisase | — | — |
| fortinet | fortisase | — | — |