CVE-2022-40722highCWE-780

Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.3%

probabilidade de exploração

0.3%top 75% das CVEs

exploração observada

nãonenhuma fonte reporta

A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

Produtos afetados

Ping Identity · PingFederate (includes PingID Adapter)Ping Identity · PingID Adapter for PingFederate Ping Identity · PingID Integration Kit (includes PingID Adapter)

Referências

https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_20_rn