CVE-2022-23720: PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file
First published: Thu Jun 30 2022(Updated: )
PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID Windows Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads to an increased risk of exposure or discovery, and an attacker could leverage these credentials to perform administrative actions against PingID APIs or endpoints.
Credit: responsible-disclosure@pingidentity.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pingidentity Pingid Integration For Windows Login | <2.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-23720.
What is the severity of CVE-2022-23720?
The severity of CVE-2022-23720 is high.
How does CVE-2022-23720 affect PingID Windows Login?
CVE-2022-23720 affects PingID Windows Login prior to version 2.8.
What is the impact of CVE-2022-23720?
The impact of CVE-2022-23720 is that PingID Windows Login does not alert or halt operation if it has been provisioned with the full permissions PingID properties file.
How can I fix CVE-2022-23720?
To fix CVE-2022-23720, upgrade PingID Windows Login to version 2.8 or higher.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/severity
- agent/author
- agent/weakness
- agent/description
- agent/event
- agent/tags
- agent/first-publish-date
- vendor/pingidentity
- canonical/pingidentity pingid integration for windows login