Session cookie does not expire after logout
Summary
An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)
Affected Products
FortiClientEMS version 6.2.8 and below.
FortiClientEMS version 6.4.2 and below.
Solutions
Please upgrade to FortiClientEMS version 6.2.9 or above.
Please upgrade to FortiClientEMS version 6.4.3 or above.
Please upgrade to FortiClientEMS version 7.0.0 or above.