The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-028 advisory.

– An insufficient session expiration [CWE-613] vulnerability in FortiOS REST API may allow an attacker to reuse the session of a deleted user, should the attacker manage to obtain the API token. (CVE-2023-28001)

Note that Nessus has not tested for this issue but has instead relied only on the application’s self-reported version number.Read More