Headline
CVE-2023-33303: Fortiguard
A insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands via api request
** PSIRT Advisories**
FortiEDR - Session API token does not expires after a renewal
Summary
An insufficient session expiration vulnerability [CWE-613] in FortiEDR may allow an attacker to reuse the unexpired user API access token to gain privileges, should the attacker be able to obtain that API access token (via other, hypothetical attacks).
Affected Products
FortiEDR version 5.0.0 through 5.0.3:873
FortiEDR version 5.2.0:2500 and below.
Solutions
Please upgrade to FortiEDR version 5.2.0.2501 or above
Please upgrade to FortiEDR version 5.0.3.873 or above
Acknowledgement
Fortinet is pleased to thank security researcher Kevin Carli for discovering and reporting this vulnerability under responsible disclosure.
Timeline
2023-09-29: Initial publication