BaseFortify

Publication date: 2025-10-14

Last updated on: 2025-10-15

Assigner: Fortinet, Inc.

Description

An insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 through 2.4.4, 2.3 all versions, 2.2.0, 2.1 all versions, 2.0 all versions authentication mechanism may allow remote unauthenticated attacker to deauthenticate logged in admins via crafted cookie and remote authenticated read-only attacker to gain write privilege via crafted cookie.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-14

Last Modified

2025-10-15

Generated

2026-07-06

AI Q&A

2025-10-14

EPSS Evaluated

2026-07-05

NVD

CVE-2024-33507

Affected Vendors & Products

Vendor	Product	Version / Range
fortinet	fortiisolator	From 2.3.0 (inc) to 2.4.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability in FortiIsolator versions 2.0 through 2.4.4 involves insufficient session expiration and incorrect authorization in the authentication mechanism. It allows a remote unauthenticated attacker to deauthenticate logged-in administrators by using a crafted cookie. Additionally, a remote authenticated attacker with read-only privileges can escalate their privileges to write access by exploiting the same crafted cookie vulnerability.

Impact Analysis

The vulnerability can impact you by allowing attackers to forcibly log out administrators, disrupting management and potentially causing denial of service. Moreover, attackers with limited read-only access can gain write privileges, which could lead to unauthorized changes, data manipulation, or further compromise of the system.

Hi! I’m here to help you understand CVE-2024-33507. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70