CVE-2022-22302 Information disclosure in FortiAuthenticator

What is CVE-2022-22302?

CVE-2022-22302 is a medium-severity vulnerability in Fortinet Fortios, published on 11 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via accessing the files on the filesystem.

Weakness: CWE-312

Which versions are affected by CVE-2022-22302?

It affects 2 products.

Products include Fortinet Fortiauthenticator, Fortinet Fortios.

How do I fix CVE-2022-22302?

No fix has been published for CVE-2022-22302 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-22302 being exploited?

There is no known exploitation of CVE-2022-22302 in the wild and no public exploit code.

Other vulnerabilities in Fortinet Fortios

• CVE-2026-44277 Missing authorization in FortiAuthenticator Critical 9.1
• CVE-2013-6990 Privilege escalation in n/a Critical 9.0
• CVE-2021-43067 Information disclosure in Fortinet FortiAuthenticator High 8.3
• CVE-2021-22124 Denial of service in Fortinet FortiSandbox, FortiAuthenticator High 7.5
• CVE-2015-1455 Hardcoded credentials in n/a High 7.5

All Fortinet Fortios vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vcgf-cp2m-h8gw.