CVE-2024-33507
Description
An insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 through 2.4.4, 2.3 all versions, 2.2.0, 2.1 all versions, 2.0 all versions authentication mechanism may allow remote unauthenticated attacker to deauthenticate logged in admins via crafted cookie and remote authenticated read-only attacker to gain write privilege via crafted cookie.
Summary dbcve.org
FortiIsolator contains two authentication mechanism flaws: (1) insufficient session expiration allowing unauthenticated attackers to deauthorize logged-in admins via crafted cookies, and (2) incorrect authorization allowing authenticated read-only users to escalate to write privileges via crafted cookies. Both vulnerabilities stem from improper validation of session/authorization data in cookies.
Mitigation
Upgrade FortiIsolator to version 2.4.5 or later. For older versions, apply vendor-supplied patches or consider compensating controls such as network segmentation and enhanced monitoring until upgrade is feasible.