{"id":"CVE-2025-22256","state":"PUBLISHED","title":"A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 throu","description":"A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 through 1.4.1 allows attacker to improper access control via specially crafted HTTP requests","publishedAt":"2025-06-10T16:36:15.866Z","updatedAt":"2025-06-10T19:39:51.038Z","severity":{"score":6,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiPAM","Fortinet FortiSRA"],"affected":[{"vendor":"Fortinet","product":"FortiPAM","defaultStatus":"unaffected","versions":[{"version":"1.4.0","status":"affected","lessThanOrEqual":"1.4.1","versionType":"semver"},{"version":"1.3.0","status":"affected"},{"version":"1.2.0","status":"affected"},{"version":"1.1.0","status":"affected","lessThanOrEqual":"1.1.2","versionType":"semver"},{"version":"1.0.0","status":"affected","lessThanOrEqual":"1.0.3","versionType":"semver"}],"cpes":["cpe:2.3:o:fortinet:fortipam:1.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.3.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:*"]},{"vendor":"Fortinet","product":"FortiSRA","defaultStatus":"unaffected","versions":[{"version":"1.4.0","status":"affected","lessThanOrEqual":"1.4.1","versionType":"semver"}],"cpes":["cpe:2.3:a:fortinet:fortisra:1.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisra:1.4.0:*:*:*:*:*:*:*"]}],"references":["https://fortiguard.fortinet.com/psirt/FG-IR-25-008"],"weaknesses":["CWE-280"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/22xxx/CVE-2025-22256.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-22256","state":"PUBLISHED","datePublished":"2025-06-10T16:36:15.866Z","dateUpdated":"2025-06-10T19:39:51.038Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2025-01-02T10:21:04.197Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 through 1.4.1 allows attacker to improper access control via specially crafted HTTP requests"}],"affected":[{"vendor":"Fortinet","product":"FortiPAM","defaultStatus":"unaffected","versions":[{"version":"1.4.0","status":"affected","lessThanOrEqual":"1.4.1","versionType":"semver"},{"version":"1.3.0","status":"affected"},{"version":"1.2.0","status":"affected"},{"version":"1.1.0","status":"affected","lessThanOrEqual":"1.1.2","versionType":"semver"},{"version":"1.0.0","status":"affected","lessThanOrEqual":"1.0.3","versionType":"semver"}],"cpes":["cpe:2.3:o:fortinet:fortipam:1.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.3.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:*"]},{"vendor":"Fortinet","product":"FortiSRA","defaultStatus":"unaffected","versions":[{"version":"1.4.0","status":"affected","lessThanOrEqual":"1.4.1","versionType":"semver"}],"cpes":["cpe:2.3:a:fortinet:fortisra:1.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisra:1.4.0:*:*:*:*:*:*:*"]}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-008","name":"https://fortiguard.fortinet.com/psirt/FG-IR-25-008"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-280","lang":"en","description":"Improper access control","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2025-06-10T16:36:15.866Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiPAM version 1.5.0 or above \nPlease upgrade to FortiPAM version 1.4.2 or above \nPlease upgrade to FortiPAM version 1.3.1 or above \nPlease upgrade to FortiPAM version 1.2.1 or above \nPlease upgrade to FortiPAM version 1.1.3 or above \nPlease upgrade to FortiPAM version 1.0.4 or above \nPlease upgrade to FortiSRA version 1.5.0 or above \nPlease upgrade to FortiSRA version 1.4.2 or above"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-10T19:29:52.515467Z","id":"CVE-2025-22256","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-10T19:39:51.038Z"}}]}}}