CVE-2024-50562

Description

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.

Remediation

Solution:

  • Please upgrade to FortiOS version 7.6.1 or above Please upgrade to FortiOS version 7.4.8 or above Please upgrade to FortiOS version 7.2.11 or above Please upgrade to FortiSASE version 24.4.c or above

Category

4.8
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.36%
Vendor Advisory fortinet.com
Affected: Fortinet FortiOS
Affected: Fortinet FortiPAM
Affected: Fortinet FortiProxy
Published at:
Updated at:

References

Link Tags
https://fortiguard.fortinet.com/psirt/FG-IR-24-339 vendor advisory

Frequently Asked Questions

What is the severity of CVE-2024-50562?
CVE-2024-50562 has been scored as a medium severity vulnerability.
How to fix CVE-2024-50562?
To fix CVE-2024-50562: Please upgrade to FortiOS version 7.6.1 or above Please upgrade to FortiOS version 7.4.8 or above Please upgrade to FortiOS version 7.2.11 or above Please upgrade to FortiSASE version 24.4.c or above
Is CVE-2024-50562 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-50562 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-50562?
CVE-2024-50562 affects Fortinet FortiOS, Fortinet FortiPAM, Fortinet FortiProxy.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.