Session cookie does not expire after logout Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-20-072 Final 1 1 2021-10-05T00:00:00 Current version 2021-10-05T00:00:00 2021-10-05T00:00:00 An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks) Escalation of privilege FortiClientEMS version 6.2.8 and below.FortiClientEMS version 6.4.2 and below. Please upgrade to FortiClientEMS version 6.2.9 or above.Please upgrade to FortiClientEMS version 6.4.3 or above.Please upgrade to FortiClientEMS version 7.0.0 or above. Fortinet is pleased to thank Researcher Johnatan Camargo and Researcher Danilo Costa for reporting this vulnerability under responsible disclosure. CVE-2021-24019 7.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X https://fortiguard.fortinet.com/psirt/FG-IR-20-072 Session cookie does not expire after logout Reference>