Session API token does not expires after a renewal
Summary
An insufficient session expiration vulnerability [CWE-613] in FortiEDR Central Manager may allow an attacker to reuse the unexpired user API access token to gain privileges, should the attacker be able to obtain that API access token (via other, hypothetical attacks).
Affected Products
FortiEDR version 5.0.0 through 5.0.1
Solutions
Please upgrade to FortiEDR version 5.2.0.2501 or above
Please upgrade to FortiEDR version 5.0.3.873 or above
Acknowledgement
Fortinet is pleased to thank security researcher Kevin Carli for discovering and reporting this vulnerability under responsible disclosure.Timeline
2023-09-29: Initial publication