PT-2022-3284 · Ping Identity · Pingid Windows Login

Published 2022-06-30 · Updated 2023-07-03 · CVE-2022-23719

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PingID Windows Login versions prior to 2.8

Description The issue is related to errors in authentication of the connection with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine may be able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code being executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication.

Recommendations For versions prior to 2.8, update to version 2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the local Java service used by PingID Windows Login to minimize the risk of exploitation. Avoid using the vulnerable communication channel with the local Java service until the issue is resolved.

Fix

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-306

CWE-288

CWE-310

Related Identifiers

BDU:2022-04019

CVE-2022-23719

Affected Products

Pingid Windows Login

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-23719 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23719 · Vendor Advisory
• https://pingidentity.com/en/resources/downloads/pingid.html · Vendor Advisory
• https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04019 · Security Note
• https://t.me/cvenotify/32904 · Telegram Post
• https://t.me/cvenotify/53587 · Telegram Post