CVE-2020-6644

HIGH

FortiDeceptor < 3.0.0 - Insufficient Session Expiration

Title source: llm

Description

An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://fortiguard.com/advisory/FG-IR-20-006

Scores

CVSS v3 8.1

EPSS 0.0041

EPSS Percentile 61.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-613

Status published

Products (1)

fortinet/fortideceptor < 3.0.0

Published Jun 22, 2020

Tracked Since Feb 18, 2026