FG-IR-22-445: GUI Console WebSockets do not terminate on logout
An insufficient session expiration vulnerability [CWE-613] in FortiOS, FortiProxy, FortiPAM & FortiSwitchManager GUI may allow attackers to re-use websessions after GUI logout, should they manage to acquire the required credentials.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-22-445?
The FG-IR-22-445 vulnerability is classified as having an insufficient session expiration severity level.
How do I fix FG-IR-22-445?
To address FG-IR-22-445, upgrade your FortiOS, FortiProxy, FortiPAM, or FortiSwitchManager to the latest patched version as specified in the advisory.
Which products are affected by FG-IR-22-445?
FG-IR-22-445 affects FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager, particularly versions prior to their respective patched releases.
Can FG-IR-22-445 be exploited remotely?
Yes, FG-IR-22-445 can be exploited remotely if an attacker obtains the required credentials.
What type of vulnerability is FG-IR-22-445?
FG-IR-22-445 is an insufficient session expiration vulnerability, specifically identified as CWE-613.