FortiOS & FortiProxy - administrator cookie leakage

An insufficiently protected credentials vulnerability (CWE-522) in FortiOS and FortiProxy may allow an attacker to obtain the administrator cookie in rare and specific conditions, via tricking the administrator into visiting a malicious attacker-controlled website through the SSL-VPN.

administrator attacker conditions cookie credentials cwe fortios fortiproxy malicious may ssl vpn vulnerability website