Lucene search

[email protected]CVE-2022-23722

HistoryMay 02, 2022 - 10:15 p.m.

CVE-2022-23722

2022-05-0222:15:09

CWE-288

CWE-287

[email protected]

web.nvd.nist.gov

695

nvd

cve-2022-23722

authentication api

password reset

authentication policy

email one-time password

pingid

sms authentication

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.9%

JSON

When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.

Affected configurations

NVD

Node

pingidentitypingfederateRange9.3.0–9.3.3

pingidentitypingfederateRange10.0.0–10.0.12

pingidentitypingfederateRange10.1.0–10.1.9

pingidentitypingfederateRange10.2.0–10.2.7

pingidentitypingfederateRange10.3.0–10.3.4

pingidentitypingfederateMatch9.3.3p15

pingidentitypingfederateMatch11.0.0

CPENameOperatorVersion
pingidentity:pingfederatepingidentity pingfederatelt9.3.3
pingidentity:pingfederatepingidentity pingfederatelt10.0.12
pingidentity:pingfederatepingidentity pingfederatelt10.1.9
pingidentity:pingfederatepingidentity pingfederatelt10.2.7
pingidentity:pingfederatepingidentity pingfederatelt10.3.4
pingidentity:pingfederatepingidentity pingfederateeq11.0.0

CPE	Name	Operator	Version
pingidentity:pingfederate	pingidentity pingfederate	lt	9.3.3
pingidentity:pingfederate	pingidentity pingfederate	lt	10.0.12
pingidentity:pingfederate	pingidentity pingfederate	lt	10.1.9
pingidentity:pingfederate	pingidentity pingfederate	lt	10.2.7
pingidentity:pingfederate	pingidentity pingfederate	lt	10.3.4
pingidentity:pingfederate	pingidentity pingfederate	eq	11.0.0

CNA Affected

[
  {
    "product": "PingFederate",
    "vendor": "Ping Identity",
    "versions": [
      {
        "lessThanOrEqual": "11.0",
        "status": "affected",
        "version": "11.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "10.3.4",
        "status": "affected",
        "version": "10.3",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "10.2.7",
        "status": "affected",
        "version": "10.2",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "10.1.9",
        "status": "affected",
        "version": "10.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "10.0.12",
        "status": "affected",
        "version": "10.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "9.3.3P16",
        "status": "affected",
        "version": "9.3",
        "versionType": "custom"
      }
    ]
  }
]

References

docs.pingidentity.com/bundle/pingfederate-110/page/spk1642790928508.html

www.pingidentity.com/en/resources/downloads/pingfederate.html

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.9%

JSON

Related for CVE-2022-23722

prion1 cvelist1 nvd1