Vulnerability Description
A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via accessing the files on the filesystem.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortiauthenticator | >= 6.0.0, <= 6.0.4 |
| Fortinet | Fortios | >= 6.0.0, <= 6.0.13 |
Related Weaknesses (CWE)
References
- https://fortiguard.com/psirt/FG-IR-20-014Vendor Advisory
- https://fortiguard.com/psirt/FG-IR-20-014Vendor Advisory
FAQ
What is CVE-2022-22302?
CVE-2022-22302 is a vulnerability with a CVSS score of 5.3 (MEDIUM). A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 a...
How severe is CVE-2022-22302?
CVE-2022-22302 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-22302?
Check the references section above for vendor advisories and patch information. Affected products include: Fortinet Fortiauthenticator, Fortinet Fortios.