{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-22302", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2022-01-03T09:39:36.529Z", "datePublished": "2023-07-11T08:54:00.679Z", "dateUpdated": "2024-08-03T03:07:50.281Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiAuthenticator", "defaultStatus": "unaffected", "versions": [{"version": "6.1.0", "status": "affected"}, {"versionType": "semver", "version": "6.0.0", "lessThanOrEqual": "6.0.4", "status": "affected"}, {"version": "5.5.0", "status": "affected"}]}, {"vendor": "Fortinet", "product": "FortiOS", "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "6.4.0", "lessThanOrEqual": "6.4.1", "status": "affected"}, {"versionType": "semver", "version": "6.2.0", "lessThanOrEqual": "6.2.9", "status": "affected"}, {"versionType": "semver", "version": "6.0.0", "lessThanOrEqual": "6.0.13", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via accessing the files on the filesystem."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2023-07-11T08:54:00.679Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-312", "description": "Information disclosure", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:X/RC:X"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiGate version 6.4.2 or above.\r\nPlease upgrade to FortiOS version 6.2.10 or above\r\nPlease upgrade to FortiOS version 6.0.14 or above\n\r\nPlease upgrade to FortiAuthenticator version 6.2.0 or above\r\nPlease upgrade to FortiAuthenticator version 6.1.1 or above\r\nPlease upgrade to FortiAuthenticator version 6.0.5 or above\n\n\r\nWorkaround in FortiOS:\r\nDisable the FTM push service by using the below commands:\r\nconfig system ftm-push\r\nset status disable\r\nend"}], "references": [{"name": "https://fortiguard.com/psirt/FG-IR-20-014", "url": "https://fortiguard.com/psirt/FG-IR-20-014"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:07:50.281Z"}, "title": "CVE Program Container", "references": [{"name": "https://fortiguard.com/psirt/FG-IR-20-014", "url": "https://fortiguard.com/psirt/FG-IR-20-014", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiauthenticator:*:*:*:*:*:*:*:*", "matchCriteriaId": "47A3EAE7-BA29-4267-BF88-61ACA9F40AC7", "versionEndIncluding": "6.0.4", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiauthenticator:5.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "0C30DF6A-2839-4B19-AF75-2A5BD82CB0BA", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiauthenticator:6.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "8BCCE874-8B7F-4A4A-9A28-C32280E77708", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "matchCriteriaId": "A6EF01D9-50FB-4300-87FB-132649A9AC51", "versionEndIncluding": "6.0.13", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4C0308D-8E52-456B-BFC2-62D4C1E9BDC3", "versionEndIncluding": "6.2.9", "versionStartIncluding": "6.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "1C6E45EB-4C8C-4777-9200-08B14595A3A7", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "9D114536-7169-4814-B011-570E3AD86A3D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via accessing the files on the filesystem."}], "id": "CVE-2022-22302", "lastModified": "2023-11-07T03:43:51.670", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@fortinet.com", "type": "Secondary"}]}, "published": "2023-07-11T09:15:09.073", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.com/psirt/FG-IR-20-014"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-312"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}

{}