PSIRTInsufficient Session Expiration in SSLVPN
Summary
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSLVPN may allow an attacker to maintain access to network resources via an active session not terminated after a user's password change under particular conditions outside of the attacker's control
| Version | Affected | Solution |
|---|---|---|
| FortiOS 7.6 | Not affected | Not applicable |
| FortiOS 7.4 | 7.4.0 | Upgrade to 7.4.1 or above |
| FortiOS 7.2 | 7.2 all versions | Migrate to a fixed release |
| FortiOS 7.0 | 7.0 all versions | Migrate to a fixed release |
| FortiOS 6.4 | 6.4 all versions | Migrate to a fixed release |