Session cookie does not expire after logout

Summary

An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)

Affected Products

FortiClientEMS version 6.2.8 and below.
FortiClientEMS version 6.4.2 and below.

Solutions

Please upgrade to FortiClientEMS version 6.2.9 or above.
Please upgrade to FortiClientEMS version 6.4.3 or above.
Please upgrade to FortiClientEMS version 7.0.0 or above.

Acknowledgement

Fortinet is pleased to thank Researcher Johnatan Camargo and Researcher Danilo Costa for reporting this vulnerability under responsible disclosure.

Timeline

2021-10-05: Initial publication