FortiClientEMS - Session cookie does not expire after logout
An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)
FortiClientEMS version 6.2.8 and below.
FortiClientEMS version 6.4.2 and below.
Please upgrade to FortiClientEMS version 6.2.9Â or above.
Please upgrade to FortiClientEMS version 6.4.3 or above.
Please upgrade to FortiClientEMS version 7.0.0 or above.