all InfoSec news logo
all InfoSec news - Your InfoSec news aggregator
Log in Sign up
all InfoSec news

FortiOS - Existing websocket connection persists after deleting API admin

Add to bookmarks
July 11, 2023, 7 a.m. |

FortiGuard Labs | FortiGuard Center - IR Advisories fortiguard.fortinet.com

An insufficient session expiration [CWE-613] vulnerability in FortiOS REST API may allow an attacker to reuse the session of a deleted user, should the attacker manage to obtain the API token.

api cwe expiration fortios manage may rest rest api reuse session token vulnerability websocket

Visit resource

More from fortiguard.fortinet.com / FortiGuard Labs | FortiGuard Center - IR Advisories

FortiOS - Web server ETag exposure 3 weeks, 4 days ago | fortiguard.fortinet.com
actor attacker cwe device +17
FortiSandbox - Arbitrary file read on endpoint 3 weeks, 4 days ago | fortiguard.fortinet.com
arbitrary files attacker cwe directory +12
FortiNAC-F - Lack of certificate validation 3 weeks, 4 days ago | fortiguard.fortinet.com
attack attacker certificate channel +12
FortiOS - Format String in CLI command 3 weeks, 4 days ago | fortiguard.fortinet.com
access admin arbitrary code attacker +16
FortiOS & FortiProxy - administrator cookie leakage 3 weeks, 4 days ago | fortiguard.fortinet.com
administrator attacker conditions cookie +10
FortiSandbox - Arbitrary file delete on endpoint 3 weeks, 4 days ago | fortiguard.fortinet.com
arbitrary files attacker cwe delete +13
FortiClientMac - Lack of configuration file validation 3 weeks, 4 days ago | fortiguard.fortinet.com
arbitrary code attacker code configuration +15
FortiManager - Code Injection via Jinja Template 3 weeks, 4 days ago | fortiguard.fortinet.com
arbitrary code attacker code code injection +11
FortiSandbox - Arbitrary file write on CLI leading to arbitrary code execution 3 weeks, 4 days ago | fortiguard.fortinet.com
access admin arbitrary code arbitrary code execution +16

Jobs in InfoSec / Cybersecurity

Post a job on infosec-jobs.com Find talent on infosec-jobs.com

Network Security Administrator

@ Peraton | United States
View on infosec-jobs.com

IT Security Engineer 2

@ Oracle | BENGALURU, KARNATAKA, India
View on infosec-jobs.com

Sr Cybersecurity Forensics Specialist

@ Health Care Service Corporation | Chicago (200 E. Randolph Street)
View on infosec-jobs.com

Security Engineer

@ Apple | Hyderabad, Telangana, India
View on infosec-jobs.com

Cyber GRC & Awareness Lead

@ Origin Energy | Adelaide, SA, AU, 5000
View on infosec-jobs.com

Senior Security Analyst

@ Prenuvo | Vancouver, British Columbia, Canada
View on infosec-jobs.com
View more jobs