{"id":"CVE-2022-45862","state":"PUBLISHED","title":"An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versio","description":"An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; FortiSwitchManager 7.2.1 and below, 7.0 all versions GUI may allow attackers to re-use websessions after GUI logout, should they manage to acquire the required credentials.","publishedAt":"2024-08-13T15:51:57.147Z","updatedAt":"2024-08-13T17:32:25.867Z","severity":{"score":3.5,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiPAM","Fortinet FortiProxy","Fortinet FortiOS","Fortinet FortiSwitchManager"],"affected":[{"vendor":"Fortinet","product":"FortiPAM","defaultStatus":"unaffected","versions":[{"version":"1.3.0","status":"affected"},{"version":"1.2.0","status":"affected"},{"version":"1.1.0","status":"affected","lessThanOrEqual":"1.1.2","versionType":"semver"},{"version":"1.0.0","status":"affected","lessThanOrEqual":"1.0.3","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiProxy","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.11","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.18","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiOS","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.5","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.7","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.11","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiSwitchManager","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.1","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.2","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-22-445"],"weaknesses":["CWE-613"],"ingestedAt":"2026-10-29T19:50:51.061Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/45xxx/CVE-2022-45862.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-45862","state":"PUBLISHED","datePublished":"2024-08-13T15:51:57.147Z","dateUpdated":"2024-08-13T17:32:25.867Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2022-11-23T14:57:05.613Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; FortiSwitchManager 7.2.1 and below, 7.0 all versions GUI may allow attackers to re-use websessions after GUI logout, should they manage to acquire the required credentials."}],"affected":[{"vendor":"Fortinet","product":"FortiPAM","defaultStatus":"unaffected","versions":[{"version":"1.3.0","status":"affected"},{"version":"1.2.0","status":"affected"},{"version":"1.1.0","status":"affected","lessThanOrEqual":"1.1.2","versionType":"semver"},{"version":"1.0.0","status":"affected","lessThanOrEqual":"1.0.3","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiProxy","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.11","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.18","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiOS","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.5","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.7","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.11","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiSwitchManager","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.1","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.2","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-445","name":"https://fortiguard.com/psirt/FG-IR-22-445"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-613","lang":"en","description":"Improper access control","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2024-08-13T15:51:57.147Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiOS version 7.4.0 or above \nPlease upgrade to FortiOS version 7.2.6 or above \nPlease upgrade to FortiPAM version 1.4.0 or above \nPlease upgrade to FortiProxy version 7.4.0 or above \nPlease upgrade to FortiSwitchManager version 7.2.2 or above"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-13T17:32:08.496052Z","id":"CVE-2022-45862","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-13T17:32:25.867Z"}}]}}}