CyberCVE

CVE-2024-27779

An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2

Severity
Medium 6.3
CVSS 3.1
Exploited
Not listed
EPSS
0.005
38.5th percentile
Discovered by
Not disclosed
Published
Jul 18, 2025
Assigned by fortinet

Description

An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remote attacker in possession of an admin session cookie to keep using that admin's session even after the admin user was deleted.

Weakness: CWE-613

Affected products

Vendor Product Category Matched by
Fortinet FortiIsolator SASE / SSE / Secure Web cna-assigner
Fortinet FortiSandbox Threat Detection & Sandbox cna-assigner
Vendor-reported affected versions (2)
  • Fortinet · FortiSandbox
  • Fortinet · FortiIsolator

Vendor remediation

Upgrade to FortiSandbox version 4.4.5 or above Upgrade to FortiSandbox version 4.2.7 or above Upgrade to FortiIsolator version 2.4.5 or above

References