{"id":"CVE-2022-45859","aliases":["EUVD-2022-48712","GHSA-9v39-cw8g-p5rj"],"status":"published","title":"An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4...","description":"An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a local attacker with system access to retrieve users' passwords.","severity":{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:F/RL:X/RC:R","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00143,"percentile":0.03652,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-522"],"published":"2023-05-03T21:26:47Z","modified":"2026-06-17T05:10:52Z","products":[{"vendor":"fortinet","product":"fortinac"},{"vendor":"fortinet","product":"fortinac-f"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-456","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45859"},{"url":"https://github.com/advisories/GHSA-9v39-cw8g-p5rj"}],"sources":{"cve":[{"id":"CVE-2022-45859","description":"An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a local attacker with system access to retrieve users' passwords.","status":"published","published":"2023-05-03T21:26:47.577Z","modified":"2024-10-22T20:46:40.435Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:F/RL:X/RC:R","level":"low","assessor":"cna"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:34:31.519788Z"}],"euvd":[{"id":"EUVD-2022-48712","description":"An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a local attacker with system access to retrieve users' passwords.","status":"published","published":"2023-05-03T21:26:47Z","modified":"2024-10-22T20:46:40Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:F/RL:X/RC:R","level":"low"}],"updated_at":"2026-11-03T00:05:22.224445Z"}],"ghsa":[{"id":"GHSA-9v39-cw8g-p5rj","title":"An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4...","description":"An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a local attacker with system access to retrieve users' passwords.","status":"published","published":"2023-05-04T00:30:17Z","modified":"2024-04-04T03:47:35Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:56:18.466724Z"}],"nvd":[{"id":"CVE-2022-45859","description":"An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a local attacker with system access to retrieve users' passwords.","status":"published","published":"2023-05-03T22:15:15.553Z","modified":"2026-06-17T05:10:52.82Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:07:37.42466Z"}]}}