FG-IR-25-411: Insufficient Session Expiration in SSLVPN
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSLVPN may allow an attacker to maintain access to network resources via an active session not terminated after a user's password change under particular conditions outside of the attacker's control
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-25-411?
The severity of FG-IR-25-411 is classified as insufficient session expiration, which can lead to unauthorized access under specific conditions.
How do I fix FG-IR-25-411?
To fix FG-IR-25-411, update FortiOS to version 7.4.1 or later.
What versions of FortiOS are affected by FG-IR-25-411?
FortiOS versions 7.2.x, 7.0.x, and 6.4.x are affected by FG-IR-25-411.
What can an attacker do with FG-IR-25-411?
An attacker can maintain access to network resources through an active session that is not properly terminated after a password change.
Are session tokens vulnerable in FG-IR-25-411?
Yes, session tokens may remain valid even after a user changes their password, which is the main vulnerability in FG-IR-25-411.