CVE-2022-23719: fallo de gravedad alta en PingID Windows Login
PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.2epss 0.3%
PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication.
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Productos afectados
Ping Identity · PingID Windows LoginCVEs relacionadas — PingID Windows Login
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-23718HIGHPingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code executionEPSS 2.1%CVE-2021-41992HIGHPingID Windows Login RSA cryptographic weakness with possible offline MFA bypassEPSS 0.5%CVE-2022-23720HIGHPingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties fileEPSS 0.2%CVE-2022-23717MEDIUMPingID Windows Login prior to 2.8 denial of service conditionEPSS 0.2%CVE-2022-23725HIGHPingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstancesEPSS 0.2%