CVE-2024-27779CWE-613

An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2…

Medium · published July 18, 2025

CVSS v3.1
6.3
EPSS
1%
Percentile
46.2
In the wild
Unconfirmed
What it is

An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remote attacker in possession of an admin session cookie to keep using that admin's session even after the admin user was deleted.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L/E:P/RL:X/RC:C
CVSS v4.0
Not supplied
EPSS
0.00565 · 46.2th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2025-07-18T07:58Z
EPSS history
Timeline
  • 18 JUL 07:58Z
    An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2…
    cvelistv5