EUVD-2025-209451
GHSA-r66p-45rw-5xc2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
A server-side request forgery (ssrf) vulnerability [CWE-918] vulnerability in Fortinet FortiSOAR PaaS 7.6.4, FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.4, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated attacker to discover services running on local ports via crafted requests.
AnalysisAI
Server-side request forgery in Fortinet FortiSOAR (both PaaS and on-premise versions 7.3 through 7.6.4) allows authenticated attackers to discover services running on local ports by crafting malicious requests. The vulnerability requires valid user credentials and carries a CVSS score of 4.3 with low confidentiality impact; no public exploit code or active exploitation has been confirmed at this time.
Technical ContextAI
This server-side request forgery (SSRF) vulnerability exploits improper validation of user-supplied URLs in FortiSOAR's request handling mechanisms, classified under CWE-918. The affected products include both Fortinet FortiSOAR on-premise deployments and the cloud-based PaaS variant across multiple major versions (7.3 through 7.6.4). SSRF vulnerabilities in enterprise security orchestration platforms like FortiSOAR are particularly concerning because they operate within trusted network segments and often have access to internal services, APIs, and management interfaces that would normally be restricted to external attackers. The vulnerability requires an authenticated user context (PR:L in CVSS vector), meaning the attacker must possess valid credentials to exploit the flaw.
RemediationAI
Organizations must upgrade FortiSOAR installations to patched versions beyond those listed as affected (7.6.5 or later for 7.6.x branch, 7.5.3 or later for 7.5.x branch, 7.4.6 or later for 7.4.x branch, and 7.3.4 or later for 7.3.x branch); exact patch version confirmation should be verified against the Fortinet advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-103. For organizations unable to patch immediately, implement network-level access controls restricting FortiSOAR instances' outbound connections to only explicitly authorized internal services, and audit user access logs to FortiSOAR to identify and revoke unnecessary credentials for low-privilege accounts that do not require full platform access. Apply principle of least privilege by restricting user roles within FortiSOAR to the minimum required permissions.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today