Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2022-22302

A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthentic

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via accessing the files on the filesystem.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiAuthenticator

Default version status: unaffected

  • 6.1.0affected
  • 6.0.0 to ≤ 6.0.4affected
  • 5.5.0affected

Fortinet FortiOS

Default version status: unaffected

  • 6.4.0 to ≤ 6.4.1affected
  • 6.2.0 to ≤ 6.2.9affected
  • 6.0.0 to ≤ 6.0.13affected

References