PT-2023-13900 · Ping Identity · Pingid Desktop

Published 2023-04-25 · Updated 2023-05-04 · CVE-2022-40725

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions PingID Desktop versions prior to 1.7.4

Description The issue allows attackers to bypass the maximum PIN attempts permitted before the time-based lockout is activated. This can be exploited in PingID Desktop.

Recommendations For versions prior to 1.7.4, update to version 1.7.4 to resolve the issue.

Fix

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-306

CWE-288

Related Identifiers

CVE-2022-40725

Affected Products

Pingid Desktop

References · 4

• https://osv.dev/vulnerability/CVE-2022-40725 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40725 · Security Note
• https://docs.pingidentity.com/r/en-us/pingid/desktop_app_1.7.4 · Note
• https://t.me/cibsecurity/62830 · Telegram Post