PT-2025-24715 · Fortinet · Fortipam+1

Published 2025-06-10 · Updated 2025-06-10 · CVE-2025-22256

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiPAM versions 1.0.0 through 1.4.1 Fortinet FortiSRA versions 1.4.0 through 1.4.1

Description The issue is related to improper handling of insufficient permissions or privileges, allowing for improper access control via specially crafted HTTP requests.

Recommendations For Fortinet FortiPAM versions 1.0.0 through 1.4.1, consider restricting access to sensitive areas of the application to minimize the risk of exploitation until a patch is available. For Fortinet FortiSRA versions 1.4.0 through 1.4.1, consider restricting access to sensitive areas of the application to minimize the risk of exploitation until a patch is available.

Fix

Weakness Enumeration

CWE-280

Related Identifiers

BDU:2025-12654

CVE-2025-22256

Affected Products

Fortipam

Fortisra

References · 5

• https://osv.dev/vulnerability/CVE-2025-22256 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22256 · Security Note
• https://bdu.fstec.ru/vul/2025-12654 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-25-008 · Note
• https://twitter.com/CVEnew/status/1932512991741870261 · Twitter Post