CVE-2022-23724
8.1
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Exploitability: 2.8 / Impact: 5.2
Source: NVD
Description
Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials.
Affected (1)
Products: Pingidentity: Pingid Integration For Windows Login
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 2.4.2 |
Related CWEs
CWE-288
Authentication Bypass Using an Alternate Path or Channel
A product requires authentication, but the product has an alternate path or channel that does not require authentication.
CWE-310
CWE-310
CWE-798
Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
References (4)
Source: responsible-disclosure@pingidentity.com
Vendor Advisory
Source: responsible-disclosure@pingidentity.com
ProductVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ProductVendor Advisory
Timeline
No history available yet.