{"id":"CVE-2020-6649","state":"PUBLISHED","title":"An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain adm","description":"An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)","publishedAt":"2021-02-08T15:53:06.000Z","updatedAt":"2024-10-25T14:23:02.065Z","severity":null,"assigner":"fortinet","products":["Fortinet Fortinet FortiIsolator"],"affected":[{"vendor":"Fortinet","product":"Fortinet FortiIsolator","versions":[{"version":"FortiIsolator 2.0.1","status":"affected"}]}],"references":["https://fortiguard.com/advisory/FG-IR-20-011"],"weaknesses":[],"ingestedAt":"2026-10-29T19:47:38.312Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/6xxx/CVE-2020-6649.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-6649","state":"PUBLISHED","datePublished":"2021-02-08T15:53:06.000Z","dateUpdated":"2024-10-25T14:23:02.065Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2020-01-09T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)"}],"affected":[{"vendor":"Fortinet","product":"Fortinet FortiIsolator","versions":[{"version":"FortiIsolator 2.0.1","status":"affected"}]}],"references":[{"url":"https://fortiguard.com/advisory/FG-IR-20-011","tags":["x_refsource_CONFIRM"]}],"problemTypes":[{"descriptions":[{"description":"Escalation of privilege","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"fortinet","dateUpdated":"2021-02-08T15:53:06.000Z","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@fortinet.com","ID":"CVE-2020-6649","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Fortinet FortiIsolator","version":{"version_data":[{"version_value":"FortiIsolator 2.0.1"}]}}]},"vendor_name":"Fortinet"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)"}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Escalation of privilege"}]}]},"references":{"reference_data":[{"name":"https://fortiguard.com/advisory/FG-IR-20-011","refsource":"CONFIRM","url":"https://fortiguard.com/advisory/FG-IR-20-011"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/advisory/FG-IR-20-011","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T09:11:04.589Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-24T20:10:53.026105Z","id":"CVE-2020-6649","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-25T14:23:02.065Z"}}]}}}