CVE-2022-40723mediumCWE-305

CVE-2022-40723: medium-severity vulnerability in PingID Radius PCV

Configuration-based MFA Bypass in PingID RADIUS PCV.

Published · Updated

Follow this CVE+ Monitor PingFederate+ Monitor PingID Integration Kit

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.5%
The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:H/RL:U/RC:C
Affected products
Ping Identity · PingFederate (includes Radius PCV)Ping Identity · PingID Integration Kit (includes Radius PCV)Ping Identity · PingID Radius PCV
Related CVEs — PingID Radius PCV

In the same product, most dangerous first.

CVE-2023-39930HIGHPingFederate PingID Radius PCV Authentication BypassEPSS 0.8%