CVE-2020-29012: [FortiSandbox] fsuis token does not expire after logout
An insufficient session expiration vulnerability [CWE-613] in FortiSandbox may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID (via other, hypothetical attacks)
Other sources
An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID (via other, hypothetical attacks)
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2020-29012.
What is the severity rating of CVE-2020-29012?
The severity rating of CVE-2020-29012 is medium (5.3).
Which versions of FortiSandbox are affected by the vulnerability?
FortiSandbox versions 3.2.1 and below are affected.
How does the vulnerability in FortiSandbox allow an attacker to gain information about other users?
The vulnerability allows an attacker to reuse unexpired admin user session IDs, which can be used to gain information about other users configured on the device.
Is there a fix available for CVE-2020-29012?
Yes, upgrading to FortiSandbox version 3.2.2 or later will fix the vulnerability.