Lucene search

Ping IdentityCVE-2021-41992

HistoryApr 30, 2022 - 10:15 p.m.

CVE-2021-41992

2022-04-3022:15:08

CWE-287

CWE-288

CWE-310

Ping Identity

web.nvd.nist.gov

cve-2021-41992

pingid

windows login

rsa misconfiguration

dictionary attacks

mfa bypass

nvd

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

AI Score

5.5

Confidence

High

EPSS

Percentile

12.6%

JSON

A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.

Affected configurations

Nvd

Node

pingidentitypingid_integration_for_windows_loginRange<2.7

VendorProductVersionCPE
pingidentitypingid_integration_for_windows_login*cpe:2.3:a:pingidentity:pingid_integration_for_windows_login:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pingidentity	pingid_integration_for_windows_login	*	cpe:2.3:a:pingidentity:pingid_integration_for_windows_login::::::::

CNA Affected

[
  {
    "platforms": [
      "Windows"
    ],
    "product": "PingID Windows Login",
    "vendor": "Ping Identity",
    "versions": [
      {
        "lessThan": "2.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

docs.pingidentity.com/bundle/pingid/page/klc1641469599716.html

www.pingidentity.com/en/resources/downloads/pingid.html

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

AI Score

5.5

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2021-41992