What is CVE-2020-6644?

CVE-2020-6644 is a high-severity vulnerability in Fortinet Fortideceptor, classified under Insufficient Session Expiration. CVSS score: 8.1/10. Published 2020-06-22.

How severe is CVE-2020-6644?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in Fortinet Fortideceptor

CVE-2020-6644

An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, h…

EPSS: 0.010 (59.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Fortinet Fortideceptor
Fortinet Fortideceptor — versions 3.0.0 and below, Fixed in 3.0.1

Weakness classification (CWE)

CWE-613 — Insufficient Session Expiration

References

psirt@fortinet.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2020-6644?: CVE-2020-6644 is a high-severity vulnerability in Fortinet Fortideceptor, classified under Insufficient Session Expiration. CVSS score: 8.1/10. Published 2020-06-22.
How severe is CVE-2020-6644?: High severity. CVSS v3 base score is 8.1 out of 10.