PT-2022-11525 · Ping Identity · Pingid Mac Login

Published 2022-06-30 · Updated 2022-07-15 · CVE-2021-41995

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PingID Mac Login versions prior to 1.1

Description A misconfiguration of RSA in PingID Mac Login is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.

Recommendations For versions prior to 1.1, update to version 1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources that rely on PingID Mac Login for MFA until the update can be applied.

Fix

Improper Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-287

CWE-288

CWE-310

Related Identifiers

CVE-2021-41995

Affected Products

Pingid Mac Login

References · 5

• https://pingidentity.com/en/resources/downloads/pingid.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41995 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41995 · Vendor Advisory
• https://docs.pingidentity.com/bundle/pingid/page/hnh1653583508549.html · Vendor Advisory
• https://t.me/cvenotify/33142 · Telegram Post