Lucene search

K
cvelistPing IdentityCVELIST:CVE-2021-41993
HistoryApr 30, 2022 - 9:15 p.m.

CVE-2021-41993 PingID Android mobile application prior to 1.19 vulnerable to pre-computed dictionary attacks

2022-04-3021:15:21
CWE-310
Ping Identity
www.cve.org

6.6 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.

CNA Affected

[
  {
    "platforms": [
      "Android"
    ],
    "product": "PingID Mobile Application",
    "vendor": "Ping Identity",
    "versions": [
      {
        "lessThan": "1.19",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

6.6 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

Related for CVELIST:CVE-2021-41993