CVE-2024-27779 (GCVE-0-2024-27779)
Vulnerability from cvelistv5 – Published: 2025-07-18 07:58 – Updated: 2025-07-19 03:55
VLAI?
Summary
An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remote attacker in possession of an admin session cookie to keep using that admin's session even after the admin user was deleted.
Severity ?
CWE
- CWE-613 - Improper access control
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Fortinet | FortiSandbox |
Affected:
4.4.0 , ≤ 4.4.4
(semver)
Affected: 4.2.0 , ≤ 4.2.6 (semver) Affected: 4.0.0 , ≤ 4.0.6 (semver) Affected: 3.2.0 , ≤ 3.2.4 (semver) cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortisandbox:3.2.0:*:*:*:*:*:*:* |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27779",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-18T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-19T03:55:13.564Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:3.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:3.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:3.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:3.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisandbox:3.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiSandbox",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "4.4.4",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.2.6",
"status": "affected",
"version": "4.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.0.6",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "3.2.4",
"status": "affected",
"version": "3.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiisolator:2.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.3.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.3.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.1.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:2.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:1.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:1.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiisolator:1.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiIsolator",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "2.4.4",
"status": "affected",
"version": "2.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.3.4",
"status": "affected",
"version": "2.3.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.2.0"
},
{
"lessThanOrEqual": "2.1.2",
"status": "affected",
"version": "2.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.0.1",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.2.2",
"status": "affected",
"version": "1.2.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remote attacker in possession of an admin session cookie to keep using that admin\u0027s session even after the admin user was deleted."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L/E:P/RL:X/RC:C",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "Improper access control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-18T07:58:23.943Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-035",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-035"
}
],
"solutions": [
{
"lang": "en",
"value": "Please upgrade to FortiSandbox version 4.4.5 or above \nPlease upgrade to FortiSandbox version 4.2.7 or above \nPlease upgrade to FortiIsolator version 2.4.5 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-27779",
"datePublished": "2025-07-18T07:58:23.943Z",
"dateReserved": "2024-02-26T14:46:31.334Z",
"dateUpdated": "2025-07-19T03:55:13.564Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-27779\",\"sourceIdentifier\":\"psirt@fortinet.com\",\"published\":\"2025-07-18T08:15:25.850\",\"lastModified\":\"2025-07-22T17:07:27.987\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remote attacker in possession of an admin session cookie to keep using that admin\u0027s session even after the admin user was deleted.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de expiraci\u00f3n de sesi\u00f3n insuficiente [CWE-613] en FortiSandbox FortiSandbox versi\u00f3n 4.4.4 y anteriores, versi\u00f3n 4.2.6 y anteriores, 4.0 todas las versiones, 3.2 todas las versiones y FortiIsolator versi\u00f3n 2.4 y anteriores, 2.3 todas las versiones, 2.2 todas las versiones, 2.1 todas las versiones, 2.0 todas las versiones, 1.2 todas las versiones puede permitir que un atacante remoto en posesi\u00f3n de una cookie de sesi\u00f3n de administrador siga usando la sesi\u00f3n de ese administrador incluso despu\u00e9s de que el usuario administrador haya sido eliminado.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@fortinet.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L\",\"baseScore\":6.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.2,\"impactScore\":5.5}]},\"weaknesses\":[{\"source\":\"psirt@fortinet.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-613\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiisolator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.2.0\",\"versionEndExcluding\":\"2.4.5\",\"matchCriteriaId\":\"5FE46895-BF73-4346-900B-C9A7CD434028\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2.0\",\"versionEndExcluding\":\"4.2.7\",\"matchCriteriaId\":\"6D8EBB53-DB08-44EA-9FE4-87801ACA2C26\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.4.0\",\"versionEndExcluding\":\"4.4.5\",\"matchCriteriaId\":\"2C77A903-42B3-41D3-BDC6-E138679B5400\"}]}]}],\"references\":[{\"url\":\"https://fortiguard.fortinet.com/psirt/FG-IR-24-035\",\"source\":\"psirt@fortinet.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27779\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-18T13:16:46.846102Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-18T13:16:53.596Z\"}}], \"cna\": {\"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L/E:P/RL:X/RC:C\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.2.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.0.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.0.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.0.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.0.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:3.2.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:3.2.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:3.2.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:3.2.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortisandbox:3.2.0:*:*:*:*:*:*:*\"], \"vendor\": \"Fortinet\", \"product\": \"FortiSandbox\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.4.4\"}, {\"status\": \"affected\", \"version\": \"4.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.2.6\"}, {\"status\": \"affected\", \"version\": \"4.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.0.6\"}, {\"status\": \"affected\", \"version\": \"3.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.2.4\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:fortinet:fortiisolator:2.4.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.4.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.4.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.4.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.4.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.3.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.3.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.3.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.3.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.3.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.2.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.1.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.1.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.1.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:2.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:1.2.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:1.2.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiisolator:1.2.0:*:*:*:*:*:*:*\"], \"vendor\": \"Fortinet\", \"product\": \"FortiIsolator\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.4.4\"}, {\"status\": \"affected\", \"version\": \"2.3.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.3.4\"}, {\"status\": \"affected\", \"version\": \"2.2.0\"}, {\"status\": \"affected\", \"version\": \"2.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.1.2\"}, {\"status\": \"affected\", \"version\": \"2.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.0.1\"}, {\"status\": \"affected\", \"version\": \"1.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.2.2\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Please upgrade to FortiSandbox version 4.4.5 or above \\nPlease upgrade to FortiSandbox version 4.2.7 or above \\nPlease upgrade to FortiIsolator version 2.4.5 or above\"}], \"references\": [{\"url\": \"https://fortiguard.fortinet.com/psirt/FG-IR-24-035\", \"name\": \"https://fortiguard.fortinet.com/psirt/FG-IR-24-035\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remote attacker in possession of an admin session cookie to keep using that admin\u0027s session even after the admin user was deleted.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-613\", \"description\": \"Improper access control\"}]}], \"providerMetadata\": {\"orgId\": \"6abe59d8-c742-4dff-8ce8-9b0ca1073da8\", \"shortName\": \"fortinet\", \"dateUpdated\": \"2025-07-18T07:58:23.943Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-27779\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-07-19T03:55:13.564Z\", \"dateReserved\": \"2024-02-26T14:46:31.334Z\", \"assignerOrgId\": \"6abe59d8-c742-4dff-8ce8-9b0ca1073da8\", \"datePublished\": \"2025-07-18T07:58:23.943Z\", \"assignerShortName\": \"fortinet\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…