CVE-2020-6649

CRITICAL

FortiIsolator < 2.0.1 - Insufficient Session Expiration

Title source: llm

Description

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://fortiguard.com/advisory/FG-IR-20-011

Scores

CVSS v3 9.8

EPSS 0.0041

EPSS Percentile 61.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-613

Status published

Products (1)

fortinet/fortiisolator < 2.0.1

Published Feb 08, 2021

Tracked Since Feb 18, 2026