CVEvulnerability

CVE-2022-22302

3.3 LOW Published 2023-07-11 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-07-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
3.3 LOW — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-312

Description

A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via accessing the files on the filesystem.

Affected configurations

• fortinet fortiauthenticator (>= 6.0.0 <= 6.0.4) • fortinet fortiauthenticator 5.5.0 • fortinet fortiauthenticator 6.1.0 • fortinet fortios (>= 6.0.0 <= 6.0.13) • fortinet fortios (>= 6.2.0 <= 6.2.9) • fortinet fortios 6.4.0 • fortinet fortios 6.4.1

Related

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References