CVE-2022-23717: medium-severity vulnerability in PingID Windows Login
PingID Windows Login prior to 2.8 denial of service condition
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5epss 0.2%
PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of authentication.
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:H
Affected products
Ping Identity · PingID Windows LoginRelated CVEs — PingID Windows Login
In the same product, most dangerous first.
CVE-2022-23718HIGHPingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code executionEPSS 2.1%CVE-2021-41992HIGHPingID Windows Login RSA cryptographic weakness with possible offline MFA bypassEPSS 0.5%CVE-2022-23719HIGHPingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requestsEPSS 0.3%CVE-2022-23720HIGHPingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties fileEPSS 0.2%CVE-2022-23725HIGHPingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstancesEPSS 0.2%