CVE-2022-23719: ping identity pingid windows login

Vulnerability summary

CVE-2022-23719 is a high (CVSS 7.2) vulnerability in ping identity pingid windows login. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 19.7% of scored vulnerabilities.

Timeline

1. 30-06-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication.

• CWE-288Authentication Bypass Using an Alternate Path or ChannelThe product requires authentication, but the product has an alternate path or channel that does not require authentication.
• CWE-310Cryptographic IssuesWeaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.