Session API token does not expires after a renewal

Summary

An insufficient session expiration vulnerability [CWE-613] in FortiEDR Central Manager may allow an attacker to reuse the unexpired user API access token to gain privileges, should the attacker be able to obtain that API access token (via other, hypothetical attacks).

Affected Products

FortiEDR version 5.0.0 through 5.0.1

Solutions

Please upgrade to FortiEDR version 5.2.0.2501 or above
Please upgrade to FortiEDR version 5.0.3.873 or above

Acknowledgement

Fortinet is pleased to thank security researcher Kevin Carli for discovering and reporting this vulnerability under responsible disclosure.

Timeline

2023-09-29: Initial publication