CyberCVE

CVE-2025-22256

A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 through 1.4.1 allows atta

Severity
Medium 6
CVSS 3.1
Exploited
Not listed
EPSS
0.003
23.3th percentile
Discovered by
Not disclosed
Published
Jun 10, 2025
Assigned by fortinet

Description

A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 through 1.4.1 allows attacker to improper access control via specially crafted HTTP requests

Weakness: CWE-280

Affected products

Vendor Product Category Matched by
Fortinet FortiPAM Identity / IAM / MFA cna-assigner
Fortinet FortiSRA VPN & Remote Access cna-assigner
Vendor-reported affected versions (2)
  • Fortinet · FortiPAM
  • Fortinet · FortiSRA

Vendor remediation

Please upgrade to FortiPAM version 1.5.0 or above Please upgrade to FortiPAM version 1.4.2 or above Please upgrade to FortiPAM version 1.3.1 or above Please upgrade to FortiPAM version 1.2.1 or above Please upgrade to FortiPAM version 1.1.3 or above Please upgrade to FortiPAM version 1.0.4 or above Please upgrade to FortiSRA version 1.5.0 or above Please upgrade to FortiSRA version 1.4.2 or above

References