by Kastro
Paper/Archive/CVE-2024-33507

CVE-2024-33507

Fortinet FortiIsolator — An insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0…

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
34
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 33.0.330 × 206.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 through 2.4.4, 2.3 all versions, 2.2.0, 2.1 all versions, 2.0 all versions authentication mechanism may allow remote unauthenticated attacker to deauthenticate logged in admins via crafted cookie and remote authenticated read-only attacker to gain write privilege via crafted cookie.

Affected

ProductAffectedFixed inSource
FortiIsolator2.4.0 – 2.4.4–CNA
FortiIsolator2.3.0 – 2.3.4–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
fortinet (CNA)7.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RL:X/RC:X
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reffortiguard.fortinet.com/psirt/FG-IR-24-062