Vulnerability · Published May 4, 2022 · Assigned by Ping Identity
CVE-2022-23724PingID Integration for Windows Login MFA Bypass
Medium 6.4
In plain English
A medium-severity authentication bypass in PingID Integration for Windows Login from Ping Identity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.4%top 61.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ping Identity | PingID Integration for Windows Login | unspecified – through 2.4.1 |
Weakness: CWE-310, CWE-288 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
References
- https://www.pingidentity.com/en/resources/downloads/pingid.html x_refsource_MISC
- https://docs.pingidentity.com/bundle/pingid/page/xqz1597139945488.html x_refsource_CONFIRM