PT-2022-3291 · Ping Identity · Pingid Windows Login

Published 2022-06-30 · Updated 2022-07-12 · CVE-2022-23717

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PingID Windows Login versions prior to 2.8

Description The issue is related to a denial of service condition that can occur on local machines when using offline security keys as part of the authentication process. This is due to incorrect clearance or release of resources in the multi-factor authentication (MFA) application. Exploitation of this issue can allow an attacker to cause a denial of service.

Recommendations For versions prior to 2.8, update to version 2.8 or later to resolve the issue. As a temporary workaround, consider avoiding the use of offline security keys as part of the authentication process until a patch is available. Restrict access to the authentication module to minimize the risk of exploitation.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2022-04027

CVE-2022-23717

Affected Products

Pingid Windows Login

References · 6

• https://pingidentity.com/en/resources/downloads/pingid.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23717 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23717 · Vendor Advisory
• https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04027 · Security Note
• https://t.me/cvenotify/32902 · Telegram Post