Lucene search

Ping IdentityCVE-2022-23725

HistoryJun 30, 2022 - 8:15 p.m.

CVE-2022-23725

2022-06-3020:15:08

CWE-522

CWE-732

CWE-288

Ping Identity

web.nvd.nist.gov

643

cve-2022-23725

pingid

windows

permission

issue

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

AI Score

5.4

Confidence

High

EPSS

Percentile

12.6%

JSON

PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.

Affected configurations

Nvd

Node

pingidentitypingid_integration_for_windows_loginRange<2.8

VendorProductVersionCPE
pingidentitypingid_integration_for_windows_login*cpe:2.3:a:pingidentity:pingid_integration_for_windows_login:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pingidentity	pingid_integration_for_windows_login	*	cpe:2.3:a:pingidentity:pingid_integration_for_windows_login::::::::

CNA Affected

[
  {
    "platforms": [
      "Windows"
    ],
    "product": "PingID Windows Login",
    "vendor": "Ping Identity",
    "versions": [
      {
        "lessThan": "2.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.html

www.pingidentity.com/en/resources/downloads/pingid.html

Social References

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

AI Score

5.4

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2022-23725