CVEvulnerability

CVE-2025-25255

4.3 MEDIUM Published 2025-10-14 Modified 2026-10-18 Official page ↗
Status
Modified
Published
2025-10-14
Last modified
2026-10-18
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-358

Description

An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0.1 through 7.0.22 may allow an unauthenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.

Affected configurations

• fortinet fortiproxy (>= 7.0.1 < 7.6.4) • fortinet fortios (>= 7.6.0 < 7.6.4)

Related

Weakness · CWE (1)

  • CWE-358 Improperly Implemented Security Check for Standard weakness

References