by Kastro
Paper/Archive/CVE-2020-6649

CVE-2020-6649

Fortinet Fortinet FortiIsolator — An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the u…

EPSS 2%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 74.6.746 × 2014.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)

Affected

ProductAffectedFixed inSource
Fortinet FortiIsolatorFortiIsolator 2.0.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reffortiguard.com/advisory/FG-IR-20-011