Vulnerability · Published Oct 24, 2023 · Assigned by Ping Identity
CVE-2023-39231PingFederate PingOne MFA IK Device Pairing Second Factor Authentication Bypass
High 7.3
In plain English
A high-severity authentication bypass in PingOne MFA Integration Kit from Ping Identity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.7%top 48.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's first factor credentials.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ping Identity | PingOne MFA Integration Kit | 2.2 – before 2.2.1 |
Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N