CVE-2022-23725: fallo de gravedad alta en PingID Windows Login
PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.7epss 0.2%
PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Productos afectados
Ping Identity · PingID Windows LoginCVEs relacionadas — PingID Windows Login
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-23718HIGHPingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code executionEPSS 2.1%CVE-2021-41992HIGHPingID Windows Login RSA cryptographic weakness with possible offline MFA bypassEPSS 0.5%CVE-2022-23719HIGHPingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requestsEPSS 0.3%CVE-2022-23720HIGHPingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties fileEPSS 0.2%CVE-2022-23717MEDIUMPingID Windows Login prior to 2.8 denial of service conditionEPSS 0.2%