{"id":"CVE-2024-50562","title":"An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to lo…","summary":"An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to lo…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:R","cvssSource":"cna","cwe":["CWE-613"],"vendor":"Fortinet","product":"FortiOS","affected":["FortiOS 7.6.0","FortiOS 7.4.6","FortiOS >= 7.4.0 <= 7.4.4","FortiOS >= 7.2.0 <= 7.2.10","FortiOS >= 7.0.0 <= 7.0.17","FortiOS >= 6.4.0 <= 6.4.16","FortiPAM >= 1.4.0 <= 1.4.1","FortiPAM 1.3.0","FortiPAM 1.2.0","FortiPAM >= 1.1.0 <= 1.1.2","FortiPAM >= 1.0.0 <= 1.0.3","FortiProxy 7.6.0","FortiProxy >= 7.4.0 <= 7.4.5","FortiProxy >= 7.2.0 <= 7.2.14","FortiProxy >= 7.0.0 <= 7.0.20","FortiProxy >= 2.0.0 <= 2.0.14"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2025-06-10T19:30:09.729107Z"},"exploitAvailable":true,"published":"2025-06-10","updated":"2026-10-15","sourceUpdated":"2026-10-15T00:58:06.067Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-50562","references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-339","label":"https://fortiguard.fortinet.com/psirt/FG-IR-24-339"}],"tags":["cve.org","exploit-available"],"epss":0.01159,"epssPercentile":0.66948,"exploits":{"exploitdb":true,"github":1,"githubRepos":["https://github.com/Shahid-BugB/fortinet-cve-2024-50562"],"checkedAt":"2026-10-27T16:43:15.690Z"},"ingestedAt":"2026-10-15T04:46:37.340Z","slug":"CVE-2024-50562","body":"## Overview\n\nAn Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.\n\n## Affected\n\n- `FortiOS 7.6.0`\n- `FortiOS 7.4.6`\n- `FortiOS >= 7.4.0 <= 7.4.4`\n- `FortiOS >= 7.2.0 <= 7.2.10`\n- `FortiOS >= 7.0.0 <= 7.0.17`\n- `FortiOS >= 6.4.0 <= 6.4.16`\n- `FortiPAM >= 1.4.0 <= 1.4.1`\n- `FortiPAM 1.3.0`\n- `FortiPAM 1.2.0`\n- `FortiPAM >= 1.1.0 <= 1.1.2`\n- `FortiPAM >= 1.0.0 <= 1.0.3`\n- `FortiProxy 7.6.0`\n- `FortiProxy >= 7.4.0 <= 7.4.5`\n- `FortiProxy >= 7.2.0 <= 7.2.14`\n- `FortiProxy >= 7.0.0 <= 7.0.20`\n- `FortiProxy >= 2.0.0 <= 2.0.14`\n\n## Remediation\n\nPlease upgrade to FortiOS version 7.6.1 or above \nPlease upgrade to FortiOS version 7.4.8 or above \nPlease upgrade to FortiOS version 7.2.11 or above \nPlease upgrade to FortiSASE version 24.4.c or above","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":24.2,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[]}