← Back

CVE-2025-64447

nvd nist
Published: Dec 9, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.1
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.2 / Impact: 5.9
Source: psirt@fortinet.com (Secondary)

Description

A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to execute arbitrary operations on the system via crafted HTTP or HTTPS request via forged cookies, requiring prior knowledge of the FortiWeb serial number.

Affected (5)

Products: Fortinet: Fortiweb
Fortinet
1 product
Fortiweb
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortiweb
From 7.0.0 to 7.0.11
Fortiweb
From 7.2.0 to 7.2.11
Fortiweb
From 7.4.0 to 7.4.10
Fortiweb
From 7.6.0 to 7.6.5
Fortiweb
From 8.0.0 to 8.0.1

Related CWEs

CWE-565
Reliance on Cookies without Validation and Integrity Checking
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.