====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN365
_____________________________________________________________________

DATE                : 25/06/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running FortiDeceptor versions prior to
                                            3.1.0.

=====================================================================
https://fortiguard.com/psirt/FG-IR-20-006
_____________________________________________________________________


Session ID does not expire after logout in FortiDeceptor


Summary

An insufficient session expiration vulnerability in FortiDeceptor may
allow an attacker to reuse the unexpired admin user session IDs to gain
admin privileges, should the attacker be able to obtain that session ID
via other, hypothetical attacks.


Impact

Escalation of Privilege


Affected Products

FortiDeceptor version 3.0.0 and below.


Solutions

Please upgrade to FortiDeceptor version 3.1.0 or above.


Acknowledgement

Fortinet is pleased to thank Danilo Costa from PBI for reporting this
vulnerability under responsible disclosure.


=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================