CVE-2021-24019

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published: Oct 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-24024.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are affected are 8.0.25 and CVE-2021-240209.8A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 ma CVE-2021-240215.4An improper neutralization of input vulnerability [CWE-79] in FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below and 6.0.10 and below m CVE-2021-240224.4A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5 and below, 6.2.7 and CVE-2021-240238.8An improper input validation in FortiAI v1.4.0 and earlier may allow an authenticated user to gain system shell access via a malicious paylo CVE-2021-240246.5A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5 CVE-2021-240259.8Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer CVE-2021-240269.8A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for CVE-2021-240277.5A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third p CVE-2021-240289.8An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other un CVE-2021-240297.5A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed ass CVE-2021-24035.3Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are