PT-2022-3286 · Ping Identity · Pingid Windows Login

Published 2022-06-30 · Updated 2022-07-12 · CVE-2022-23718

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PingID Windows Login versions prior to 2.8

Description The issue is related to the use of outdated functions in the PingID multi-factor authentication (MFA) application for Windows. This can allow a remote attacker to perform a man-in-the-middle (MITM) attack. An attacker capable of achieving a sophisticated man-in-the-middle position, or compromising Ping Identity web servers, could deliver malicious code that would be executed as SYSTEM by the PingID Windows Login application.

Recommendations For versions prior to 2.8, update to version 2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the PingID Windows Login application to minimize the risk of exploitation. Avoid using the application in environments where man-in-the-middle attacks are possible until the issue is resolved.

Fix

Weakness Enumeration

CWE-1352

CWE-477

Related Identifiers

BDU:2022-04021

CVE-2022-23718

Affected Products

Pingid Windows Login

References · 6

• https://osv.dev/vulnerability/CVE-2022-23718 · Vendor Advisory
• https://pingidentity.com/en/resources/downloads/pingid.html · Vendor Advisory
• https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04021 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-23718 · Security Note
• https://t.me/cvenotify/32903 · Telegram Post