CVE-2024-50562
At a glance Severity MEDIUM 4.4 EPSS EPSS 1.16 % · percentile 67 (2026-10-27) State PUBLISHED Published 2025-06-10 Updated 2026-10-15 Assigner fortinet NVD status Modified Description An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 4.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:R fortinet CVSS 3.1 MEDIUM 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N NVD · psirt@fortinet.com (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:fortinet:fortisase:24.4.60:*:*:*:-:*:*:*cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 < 7.2.11cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.8cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*Affected products Product Versions Fortinet · FortiOS affected 7.6.0 ; affected 7.4.6 ; affected 7.4.0 ≤ 7.4.4 ; affected 7.2.0 ≤ 7.2.10 ; affected 7.0.0 ≤ 7.0.17 ; affected 6.4.0 ≤ 6.4.16 Fortinet · FortiPAM affected 1.4.0 ≤ 1.4.1 ; affected 1.3.0 ; affected 1.2.0 ; affected 1.1.0 ≤ 1.1.2 ; affected 1.0.0 ≤ 1.0.3 Fortinet · FortiProxy affected 7.6.0 ; affected 7.4.0 ≤ 7.4.5 ; affected 7.2.0 ≤ 7.2.14 ; affected 7.0.0 ≤ 7.0.20 ; affected 2.0.0 ≤ 2.0.14
References
Sources
