CVE-2020-6649

Name of the Vulnerable Software and Affected Versions: FortiIsolator versions 2.0.1 and below

Description: The issue is related to an insufficient session expiration in FortiIsolator, which may allow an attacker to reuse unexpired admin user session IDs to gain admin privileges if the attacker can obtain the session ID through other means.

Recommendations: For FortiIsolator versions 2.0.1 and below, consider implementing additional session management controls, such as manually expiring or revoking admin sessions after a certain period of inactivity, until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.