CyberCVE

CVE-2024-27779

An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2

Severity
Medium 6.3
CVSS 3.1
Exploited
Not listed
EPSS
0.005
40.2th percentile
Discovered by
Vendor
Vendor advisory field
Published
Jul 18, 2025
Assigned by fortinet

Description

An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remote attacker in possession of an admin session cookie to keep using that admin's session even after the admin user was deleted.

Weakness: CWE-613

Affected products

Vendor Product Category Matched by
Fortinet FortiIsolator SASE / SSE / Secure Web cna-assigner
Fortinet FortiSandbox Threat Detection & Sandbox cna-assigner
Vendor-reported products (2)
  • Fortinet · FortiSandbox
  • Fortinet · FortiIsolator

Credit

Internally discovered and reported by Leslie Zhou of Fortinet Vulnerability Research team.

Vendor remediation

Upgrade to FortiSandbox version 4.4.5 or above Upgrade to FortiSandbox version 4.2.7 or above Upgrade to FortiIsolator version 2.4.5 or above

References

Something wrong here?