CVE-2022-23722 PingFederate Password Reset via Authentication API Mishandling

2022-05-0222:05:13

CWE-288

Ping Identity

www.cve.org

0.001 Low

EPSS

Percentile

23.0%

JSON

When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.

CNA Affected

[
  {
    "product": "PingFederate",
    "vendor": "Ping Identity",
    "versions": [
      {
        "lessThanOrEqual": "11.0",
        "status": "affected",
        "version": "11.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "10.3.4",
        "status": "affected",
        "version": "10.3",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "10.2.7",
        "status": "affected",
        "version": "10.2",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "10.1.9",
        "status": "affected",
        "version": "10.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "10.0.12",
        "status": "affected",
        "version": "10.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "9.3.3P16",
        "status": "affected",
        "version": "9.3",
        "versionType": "custom"
      }
    ]
  }
]