VULNERABILITY INTELLIGENCE

CVE-2024-33507

CVSS score7.4 HIGH
EPSS probability0.39%
CISA KEVNot currently listed
Published2025-10-14
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Description

An insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 through 2.4.4, 2.3 all versions, 2.2.0, 2.1 all versions, 2.0 all versions authentication mechanism may allow remote unauthenticated attacker to deauthenticate logged in admins via crafted cookie and remote authenticated read-only attacker to gain write privilege via crafted cookie.

Weakness classification

  • psirt@fortinet.com: CWE-613

Primary references