Skip to main content

Fortipam CVE-2025-22256

| EUVDEUVD-2025-17802 MEDIUM
Improper Handling of Insufficient Permissions or Privileges (CWE-280)
2025-06-10 psirt@fortinet.com
Fortinet Information Disclosure Fortipam Fortisra
6.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

3
EUVD ID Assigned
Mar 14, 2026 - 19:49 euvd
EUVD-2025-17802
Analysis Generated
Mar 14, 2026 - 19:49 vuln.today
CVE Published
Jun 10, 2025 - 17:21 nvd
MEDIUM 6.3

DescriptionCVE.org

A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 through 1.4.1 allows attacker to improper access control via specially crafted HTTP requests

AnalysisAI

A security vulnerability in Fortinet FortiPAM 1.4.0 (CVSS 6.3) that allows attacker. Remediation should follow standard vulnerability management procedures.

Technical ContextAI

Vulnerability type not specified by vendor. Affects Fortinet FortiPAM 1.4.0.

RemediationAI

Monitor vendor channels for patch availability.

More in Fortipam

View all
CVE-2024-26011 CRITICAL
9.8 Nov 12

A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4
CVE-2024-23113 CRITICAL
9.8 Feb 15

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.
CVE-2023-41678 HIGH
8.8 Dec 13

A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.
CVE-2023-36639 HIGH
8.8 Dec 13

A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10,

CVE-2025-57740 HIGH
7.5 Oct 14

Authenticated remote code execution in Fortinet FortiOS, FortiProxy, and FortiPAM enables low-privileged users to trigge
CVE-2024-26010 HIGH
7.5 Jun 11

A stack-based buffer overflow in Fortinet FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiWeb, Fo
CVE-2023-45583 HIGH
7.2 May 14

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, Forti
CVE-2023-36640 MEDIUM
6.7 May 14

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, Forti
CVE-2023-40721 MEDIUM
6.7 Feb 11

A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attac
CVE-2023-45584 MEDIUM
6.6 Aug 12

A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.
CVE-2026-59837 MEDIUM
6.6 Jul 14

Stack-based buffer overflow in Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSASE enables arbitrary code execution fo
CVE-2026-23573 MEDIUM
6.1 Jul 14

Reflected or stored cross-site scripting in Fortinet FortiOS, FortiPAM, and FortiProxy web interfaces allows a remote un

Same weakness CWE-280 – Improper Handling of Insufficient Permissions or Privileges

View all
CVE-2024-24116 CRITICAL POC
9.8
CVE-2024-25108 HIGH POC
8.8
CVE-2023-27087 HIGH POC
7.5
CVE-2022-4863 MEDIUM POC
6.5
CVE-2021-38312 MEDIUM POC
6.5
CVE-2025-46066 CRITICAL
9.9
CVE-2024-46988 MEDIUM POC
5.7
CVE-2026-41566 CRITICAL
9.4

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2025-22256 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy