#VU100395 Session fixation in FortiOS - CVE-2023-50176
Published: November 12, 2024
Vulnerability identifier: #VU100395
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-50176
CWE-ID: CWE-384
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
FortiOS
FortiOS
Software vendor:
Fortinet, Inc
Fortinet, Inc
Description
The vulnerability allows a remote attacker to hijack victim's session.
The vulnerability exist due to a session fixation issue when handling SAML authentication. A remote attacker can trick the victim into clicking on a specially crafted SAML authentication link and hijack the user's session.
Successful exploitation of the vulnerability may allow an attacker to gain unauthorized access to the network with the privileges of the hijacked user account.
Remediation
Install updates from vendor's website.