CVE-2022-23720

Katalog CVE

CVSS 8.2 · High EPSS 0,24%

Kerentanan Authentication Bypass Using an Alternate Path or Channel pada pingidentity pingid integration for windows login. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID Windows Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads to an increased risk of exposure or discovery, and an attacker could leverage these credentials to perform administrative actions against PingID APIs or endpoints.

Rincian

Terbit di NVD

30 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel
CWE-648: Incorrect Use of Privileged APIs
CWE-269: Improper Privilege Management

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 14,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.html release notes · advisory vendor
• https://www.pingidentity.com/en/resources/downloads/pingid.html product · advisory vendor