CVE-2022-22302
First published: Tue Jul 11 2023(Updated: )
A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via accessing the files on the filesystem.
Credit: psirt@fortinet.com psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiAuthenticator | >=6.0.0<=6.0.4 | |
| Fortinet FortiAuthenticator | =5.5.0 | |
| Fortinet FortiAuthenticator | =6.1.0 | |
| Fortinet FortiOS | >=6.0.0<=6.0.13 | |
| Fortinet FortiOS | >=6.2.0<=6.2.9 | |
| Fortinet FortiOS | =6.4.0 | |
| Fortinet FortiOS | =6.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-22302.
What is the severity rating of CVE-2022-22302?
CVE-2022-22302 has a severity rating of medium.
Which software versions are affected by CVE-2022-22302?
CVE-2022-22302 affects FortiGate versions 6.4.0 through 6.4.1, 6.2.0 through 6.2.9, and 6.0.0 through 6.0.13, as well as FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0.
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-312.
How can a local unauthorized party exploit this vulnerability?
A local unauthorized party may exploit CVE-2022-22302 to retrieve the Fortinet private information stored in clear text.
- agent/description
- agent/type
- agent/severity
- agent/weakness
- agent/author
- agent/event
- agent/references
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-latest
- collector/nvd-index
- vendor/fortinet
- canonical/fortinet fortiauthenticator
- version/fortinet fortiauthenticator/6.0.0
- version/fortinet fortiauthenticator/6.0.4
- version/fortinet fortiauthenticator/5.5.0
- version/fortinet fortiauthenticator/6.1.0
- canonical/fortinet fortios
- version/fortinet fortios/6.0.0
- version/fortinet fortios/6.0.13
- version/fortinet fortios/6.2.0
- version/fortinet fortios/6.2.9
- version/fortinet fortios/6.4.0
- version/fortinet fortios/6.4.1