CVE-2022-22302

5.3MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortiauthenticator
FortiOS
Vendor
CVE Published:
11 July 2023

Summary

A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via accessing the files on the filesystem.

Affected Version(s)

FortiAuthenticator 6.1.0

FortiAuthenticator 6.0.0 <= 6.0.4

FortiAuthenticator 5.5.0

References

https://fortiguard.com/psirt/FG-IR-20-014

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.