CVE-2023-28001CWE-613

An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing…

Medium · published July 11, 2023

CVSS v3.1
4.1
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing the session of a deleted user in the REST API.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:U/RL:X/RC:X
CVSS v4.0
Not supplied
EPSS
0.00506 · 42.3th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2023-07-11T16:52Z
EPSS history
Timeline
  • 11 JUL 16:52Z
    An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing…
    cvelistv5