| Package | Affected versions | Patched versions |
|---|---|---|
| fortiweb | ≥ 5.6.0, < 5.9.2≥ 6.0.0, < 6.0.8≥ 6.1.0, < 6.1.3≥ 6.2.0, < 6.2.7≥ 6.3.0, < 6.3.17≥ 6.4.0, < 7.0.0 | 5.9.26.0.86.1.36.2.76.3.177.0.0 |
A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free