PT-2022-3285 · Ping Identity · Pingid Windows Login

Published 2022-06-30 · Updated 2023-07-13 · CVE-2022-23725

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions PingID Windows Login versions prior to 2.8

Description The issue is related to insufficient protection of registration data in the PingID Windows Login application, which can allow an attacker to access confidential data. The problem arises when the software does not properly set permissions on the Windows Registry entries used to store sensitive API keys under certain circumstances.

Recommendations For versions prior to 2.8, update to version 2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the Windows Registry entries used to store sensitive API keys to minimize the risk of exploitation.

Fix

Authentication Bypass Using an Alternate Path or Channel

Insufficiently Protected Credentials

Incorrect Permission

Weakness Enumeration

CWE-288

CWE-522

CWE-732

Related Identifiers

BDU:2022-04020

CVE-2022-23725

Affected Products

Pingid Windows Login

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-23725 · Security Note
• https://pingidentity.com/en/resources/downloads/pingid.html · Vendor Advisory
• https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23725 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04020 · Security Note
• https://t.me/cvenotify/54282 · Telegram Post