Vulnerability · Published Jun 30, 2022 · Assigned by Ping Identity
CVE-2022-23719PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests
High 7.2
In plain English
A high-severity authentication bypass in PingID Windows Login from Ping Identity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ping Identity | PingID Windows Login | unspecified – before 2.8 |
Weakness: CWE-310, CWE-288 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
References
- https://www.pingidentity.com/en/resources/downloads/pingid.html x_refsource_MISC
- https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.html x_refsource_MISC