CVE-2022-22302mediumCWE-312

CVE-2022-22302: medium-severity vulnerability in Fortinet FortiAuthenticator

Published · Updated

Follow this CVE+ Monitor FortiOS+ Monitor FortiAuthenticator

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via accessing the files on the filesystem.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:X/RC:X
Affected products
Fortinet · FortiAuthenticatorFortinet · FortiOS
Related CVEs — Fortinet FortiAuthenticator

In the same product, most dangerous first.

CVE-2022-42475CRITICALCVE-2022-42475EPSS 99.5%KEVCVE-2024-55591CRITICALCVE-2024-55591EPSS 94.3%KEVCVE-2026-24858CRITICALCVE-2026-24858EPSS 86.6%KEVCVE-2023-27997CRITICALCVE-2023-27997EPSS 85.7%KEVCVE-2024-21762CRITICALCVE-2024-21762EPSS 84.6%KEVCVE-2025-59718CRITICALCVE-2025-59718EPSS 68.3%KEV