PSIRTSession still active for deleted admin
Summary
An insufficient session expiration vulnerability [CWE-613] in FortiSandbox & FortiIsolator may allow a remote attacker in possession of an admin session cookie to keep using that admin's session even after the admin user was deleted.
| Version | Affected | Solution |
|---|---|---|
| FortiIsolator 3.0 | Not affected | Not Applicable |
| FortiIsolator 2.4 | 2.4.0 through 2.4.4 | Upgrade to 2.4.5 or above |
| FortiIsolator 2.3 | 2.3 all versions | Migrate to a fixed release |
| FortiIsolator 2.2 | 2.2 all versions | Migrate to a fixed release |
| FortiIsolator 2.1 | 2.1 all versions | Migrate to a fixed release |
| FortiIsolator 2.0 | 2.0 all versions | Migrate to a fixed release |
| FortiIsolator 1.2 | 1.2 all versions | Migrate to a fixed release |
| FortiSandbox 5.0 | Not affected | Not Applicable |
| FortiSandbox 4.4 | 4.4.0 through 4.4.4 | Upgrade to 4.4.5 or above |
| FortiSandbox 4.2 | 4.2.1 through 4.2.6 | Upgrade to 4.2.7 or above |
| FortiSandbox 4.0 | 4.0 all versions | Migrate to a fixed release |
| FortiSandbox 3.2 | 3.2 all versions | Migrate to a fixed release |