CVE-2023-28001: Existing websocket connection persists after deleting API admin
An insufficient session expiration [CWE-613] vulnerability in FortiOS REST API may allow an attacker to keep a secure websocket session active after user deletion.## Workaround:Restrict hosts that can connect to the websocket to trusted ones only, with the trusted host feature.
Other sources
An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing the session of a deleted user in the REST API.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2023-28001?
CVE-2023-28001 is an insufficient session expiration vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 that allows an attacker to execute unauthorized code or commands via reusing the session of a deleted user in the REST API.
What is the severity of CVE-2023-28001?
CVE-2023-28001 has a severity rating of critical (9/10).
How does CVE-2023-28001 affect Fortinet FortiOS?
CVE-2023-28001 affects Fortinet FortiOS versions 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4.
How can an attacker exploit CVE-2023-28001?
An attacker can exploit CVE-2023-28001 by reusing the session of a deleted user in the REST API to execute unauthorized code or commands.
Is there a fix available for CVE-2023-28001?
Yes, Fortinet has released a fix for CVE-2023-28001. It is recommended to update to the latest version of Fortinet FortiOS.