CVE-2022-23724

Katalog CVE

CVSS 8.1 · High EPSS 0,45%

Kerentanan Authentication Bypass Using an Alternate Path or Channel pada pingidentity pingid integration for windows login. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials.

Rincian

Terbit di NVD

4 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel
CWE-310: Cryptographic Issues
CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.pingidentity.com/bundle/pingid/page/xqz1597139945488.html advisory vendor
• https://www.pingidentity.com/en/resources/downloads/pingid.html product · advisory vendor