Lucene search

FortinetCVELIST:CVE-2020-29012

HistorySep 08, 2021 - 10:26 a.m.

CVE-2020-29012

2021-09-0810:26:31

fortinet

www.cve.org

vulnerability

fortisandbox

session expiration

CVSS3

5.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

35.9%

JSON

An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID (via other, hypothetical attacks)

CNA Affected

[
  {
    "product": "Fortinet FortiSandbox",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiSandbox 3.2.1,"
      }
    ]
  }
]

References

fortiguard.com/advisory/FG-IR-20-070

CVSS3

5.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

35.9%

JSON

Related for CVELIST:CVE-2020-29012