CVE-2020-29012

An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID (via other, hypothetical attacks)
References
Link Resource
https://fortiguard.com/advisory/FG-IR-20-070 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*

History

14 Sep 2021, 14:38

Type Values Removed Values Added
References (CONFIRM) https://fortiguard.com/advisory/FG-IR-20-070 - (CONFIRM) https://fortiguard.com/advisory/FG-IR-20-070 - Vendor Advisory
CWE CWE-613
CVSS v2 : unknown
v3 : unknown
v2 : 5.0
v3 : 5.3
CPE cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*

08 Sep 2021, 11:15

Type Values Removed Values Added
New CVE

Information

Published : 2021-09-08 11:15

Updated : 2023-12-10 13:55


NVD link : CVE-2020-29012

Mitre link : CVE-2020-29012

CVE.ORG link : CVE-2020-29012


JSON object : View

Products Affected

fortinet

  • fortisandbox
CWE
CWE-613

Insufficient Session Expiration