Session fixation in FortiOS - CVE-2023-50176
Published: November 12, 2024
Vulnerability identifier: #VU100395
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-50176
CWE-ID: CWE-384
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Fortinet, Inc
Affected software:
FortiOS
FortiOS
Detailed vulnerability description
The vulnerability allows a remote attacker to hijack victim's session.
The vulnerability exist due to a session fixation issue when handling SAML authentication. A remote attacker can trick the victim into clicking on a specially crafted SAML authentication link and hijack the user's session.
Successful exploitation of the vulnerability may allow an attacker to gain unauthorized access to the network with the privileges of the hijacked user account.
How to mitigate CVE-2023-50176
Install updates from vendor's website.