{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-22256","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","state":"PUBLISHED","assignerShortName":"fortinet","dateReserved":"2025-01-02T10:21:04.197Z","datePublished":"2025-06-10T16:36:15.866Z","dateUpdated":"2025-06-10T19:39:51.038Z"},"containers":{"cna":{"affected":[{"vendor":"Fortinet","product":"FortiPAM","cpes":["cpe:2.3:o:fortinet:fortipam:1.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.3.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","versions":[{"versionType":"semver","version":"1.4.0","lessThanOrEqual":"1.4.1","status":"affected"},{"version":"1.3.0","status":"affected"},{"version":"1.2.0","status":"affected"},{"versionType":"semver","version":"1.1.0","lessThanOrEqual":"1.1.2","status":"affected"},{"versionType":"semver","version":"1.0.0","lessThanOrEqual":"1.0.3","status":"affected"}]},{"vendor":"Fortinet","product":"FortiSRA","cpes":["cpe:2.3:a:fortinet:fortisra:1.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisra:1.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","versions":[{"versionType":"semver","version":"1.4.0","lessThanOrEqual":"1.4.1","status":"affected"}]}],"descriptions":[{"lang":"en","value":"A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 through 1.4.1 allows attacker to improper access control via specially crafted HTTP requests"}],"providerMetadata":{"orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","shortName":"fortinet","dateUpdated":"2025-06-10T16:36:15.866Z"},"problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-280","description":"Improper access control","type":"CWE"}]}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C"}}],"solutions":[{"lang":"en","value":"Please upgrade to FortiPAM version 1.5.0 or above \nPlease upgrade to FortiPAM version 1.4.2 or above \nPlease upgrade to FortiPAM version 1.3.1 or above \nPlease upgrade to FortiPAM version 1.2.1 or above \nPlease upgrade to FortiPAM version 1.1.3 or above \nPlease upgrade to FortiPAM version 1.0.4 or above \nPlease upgrade to FortiSRA version 1.5.0 or above \nPlease upgrade to FortiSRA version 1.4.2 or above"}],"references":[{"name":"https://fortiguard.fortinet.com/psirt/FG-IR-25-008","url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-008"}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-10T19:29:52.515467Z","id":"CVE-2025-22256","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-06-10T19:39:51.038Z"}}]}}