CVE-2022-40722: ping identity pingfederate (includes pingid adapter) Use of RSA Algorithm without OAEP
CVSS: 7.7v3.1HighModified
Published 25-04-2023Last modified 04-02-2025
Vulnerability summary
CVE-2022-40722 is a high (CVSS 7.7) Use of RSA Algorithm without OAEP vulnerability in ping identity pingfederate (includes pingid adapter). EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.4% of scored vulnerabilities.
CVSS score
7.7/10
010
High · v3.1 (CVE.org)EPSS score
0.33%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 25-04-2023PublishedVulnerability first disclosed.
- 04-02-2025Last modifiedVulnerability information updated.
Description
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
CVSS metrics
2 scores · 2 sources · 1 versionHigh 7.7Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:NSources2 sources · 5.8–7.7
- NVDNIST5.8MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:NDiffers
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
0.00 pp
From 0.33% on 20-09-2026
20-09-202620-10-2026
EPSS score0.33%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-780Use of RSA Algorithm without OAEPThe product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.
- CWE-327Use of a Broken or Risky Cryptographic AlgorithmThe product uses a broken or risky cryptographic algorithm or protocol.
Affected systems
Ping identity3 products
- pingfederate (includes pingid adapter)≥ 11.1.0, < 11.1.0* | 11.1.5 | ≥ 11.2.0, < 11.2.0* | 11.2.2
- pingid adapter for pingfederate≥ 2.13.2, < 2.13.2
- pingid integration kit (includes pingid adapter)≥ 2.24, < 2.24
Pingidentity3 products
- pingfederate≥ 11.1.0, ≤ 11.1.5 | ≥ 11.2.0, ≤ 11.2.2
- pingid_adapter_for_pingfederate< 2.13.2
- pingid_integration_kit< 2.24
2 vendors · 6 products