CVE-2025-22256
A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 through 1.4.1 allows atta
Description
A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 through 1.4.1 allows attacker to improper access control via specially crafted HTTP requests
Weakness: CWE-280
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiPAM | Identity / IAM / MFA | cna-assigner |
| Fortinet | FortiSRA | VPN & Remote Access | cna-assigner |
Vendor-reported products (2)
- Fortinet · FortiPAM
- Fortinet · FortiSRA
Credit
Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security team.
Vendor remediation
Please upgrade to FortiPAM version 1.5.0 or above Please upgrade to FortiPAM version 1.4.2 or above Please upgrade to FortiPAM version 1.3.1 or above Please upgrade to FortiPAM version 1.2.1 or above Please upgrade to FortiPAM version 1.1.3 or above Please upgrade to FortiPAM version 1.0.4 or above Please upgrade to FortiSRA version 1.5.0 or above Please upgrade to FortiSRA version 1.4.2 or above