PT-2022-11522 · Ping Identity · Pingid Windows Login

Published 2022-04-30 · Updated 2022-09-03 · CVE-2021-41992

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PingID Windows Login versions prior to 2.7

Description A misconfiguration of RSA in PingID Windows Login is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.

Recommendations For versions prior to 2.7, update to version 2.7 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources that rely on the affected MFA mechanism until the update is applied.

Fix

Improper Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-287

CWE-288

CWE-310

Related Identifiers

CVE-2021-41992

Affected Products

Pingid Windows Login

References · 7

• https://docs.pingidentity.com/bundle/pingid/page/klc1641469599716.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41992 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41992 · Vendor Advisory
• https://t.me/cvenotify/35689 · Telegram Post
• https://pingidentity.com/en/resources/downloads/pingid.html · Note
• https://t.me/cvenotify/29514 · Telegram Post
• https://t.me/cibsecurity/41693 · Telegram Post