Lucene search

[email protected]CVE-2022-40723

HistoryApr 25, 2023 - 7:15 p.m.

CVE-2022-40723

2023-04-2519:15:10

CWE-287

CWE-305

[email protected]

web.nvd.nist.gov

pingid

radius

pcv

pingfederate

mfa

bypass

vulnerability

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.6 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.7%

JSON

The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.

Affected configurations

NVD

Node

pingidentitypingfederateRange11.1.0–11.1.5

pingidentitypingfederateRange11.2.0–11.2.2

pingidentitypingid_integration_kitRange<2.24

pingidentityradius_pcvRange3.0.0–3.0.2

pingidentityradius_pcvMatch2.10.0

CPENameOperatorVersion
pingidentity:pingfederatepingidentity pingfederatele11.1.5
pingidentity:pingfederatepingidentity pingfederatele11.2.2
pingidentity:pingid_integration_kitpingidentity pingid integration kitlt2.24
pingidentity:radius_pcvpingidentity radius pcvlt3.0.2
pingidentity:radius_pcvpingidentity radius pcveq2.10.0

CPE	Name	Operator	Version
pingidentity:pingfederate	pingidentity pingfederate	le	11.1.5
pingidentity:pingfederate	pingidentity pingfederate	le	11.2.2
pingidentity:pingid_integration_kit	pingidentity pingid integration kit	lt	2.24
pingidentity:radius_pcv	pingidentity radius pcv	lt	3.0.2
pingidentity:radius_pcv	pingidentity radius pcv	eq	2.10.0

CNA Affected

[
  {
    "vendor": "Ping Identity",
    "product": "PingID Radius PCV",
    "versions": [
      {
        "version": "2.10.0",
        "status": "affected"
      },
      {
        "version": "3.0.0",
        "status": "affected",
        "lessThan": "3.0.0*",
        "versionType": "custom"
      },
      {
        "version": "3.0.2",
        "status": "affected",
        "lessThanOrEqual": "3.0.2",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Ping Identity",
    "product": "PingID Integration Kit (includes Radius PCV)",
    "versions": [
      {
        "version": "2.24",
        "status": "affected",
        "lessThan": "2.24",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Ping Identity",
    "product": "PingFederate (includes Radius PCV)",
    "versions": [
      {
        "version": "11.1.0",
        "status": "affected",
        "lessThan": "11.1.0*",
        "versionType": "custom"
      },
      {
        "version": "11.1.5",
        "status": "affected",
        "lessThanOrEqual": "11.1.5",
        "versionType": "custom"
      },
      {
        "version": "11.2.0",
        "status": "affected",
        "lessThan": "11.2.0*",
        "versionType": "custom"
      },
      {
        "version": "11.2.2",
        "status": "affected",
        "lessThanOrEqual": "11.2.2",
        "versionType": "custom"
      }
    ]
  }
]

References

docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_19_rn

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.6 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.7%

JSON

Related for CVE-2022-40723

cvelist1 nvd1 prion1