CVE-2022-45862

State: Published
Severity: 3.5 Low
Published: Aug 13, 2024
Updated: Aug 13, 2024
Reserved: Nov 23, 2022

Description

An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; FortiSwitchManager 7.2.1 and below, 7.0 all versions GUI may allow attackers to re-use websessions after GUI logout, should they manage to acquire the required credentials.

Scores

CVSS	Score	Vector	Source
3.1	3.5 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C	fortinet

Weaknesses

CWE-613 Improper access control

Affected Products

Product	Versions
FortiPAMFortinet	1.3.0Affected 1.2.0Affected 1.1.0 through 1.1.2Affected 1.0.0 through 1.0.3Affected
FortiProxyFortinet	7.2.0 through 7.2.11Affected 7.0.0 through 7.0.18Affected
FortiOSFortinet	7.2.0 through 7.2.5Affected 7.0.0 through 7.0.7Affected 6.4.0 through 6.4.11Affected
FortiSwitchManagerFortinet	7.2.0 through 7.2.1Affected 7.0.0 through 7.0.2Affected

References

https://fortiguard.com/psirt/FG-IR-22-445

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.