PT-2023-12732 · Ping Identity · Pingid Integration For Windows Login

Published 2023-04-25 · Updated 2023-05-04 · CVE-2022-23721

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions PingID integration for Windows login versions prior to 2.9

Description The issue arises from the PingID integration for Windows login not handling duplicate usernames. This can lead to a username collision when two people with the same username are provisioned onto the same machine at different times.

Recommendations For versions prior to 2.9, update to version 2.9 or later to resolve the issue. As a temporary workaround, consider implementing unique username provisioning to minimize the risk of username collisions. Restrict access to the Windows login integration to minimize the risk of exploitation until the issue is resolved.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-694

Related Identifiers

CVE-2022-23721

Affected Products

Pingid Integration For Windows Login

References · 4

• https://osv.dev/vulnerability/CVE-2022-23721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23721 · Security Note
• https://t.me/cibsecurity/62834 · Telegram Post
• https://docs.pingidentity.com/r/en-us/pingid/davinci_pingid_windows_login_relnotes_2.9 · Note