CVE-2022-40722: Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.
First published: Tue Apr 25 2023(Updated: )
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
Credit: responsible-disclosure@pingidentity.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pingidentity Pingfederate | >=11.1.0<=11.1.5 | |
| Pingidentity Pingfederate | >=11.2.0<=11.2.2 | |
| Pingidentity Pingid Adapter For Pingfederate | <2.13.2 | |
| Pingidentity Pingid Integration Kit | <2.24 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this misconfiguration of RSA padding?
The vulnerability ID for this misconfiguration of RSA padding is CVE-2022-40722.
What is the severity of CVE-2022-40722?
The severity of CVE-2022-40722 is high with a severity value of 5.8.
What software is affected by CVE-2022-40722?
The software affected by CVE-2022-40722 includes PingFederate (version 11.1.0 to 11.1.5 and version 11.2.0 to 11.2.2), PingID Adapter for PingFederate (version up to 2.13.2), and PingID Integration Kit (version up to 2.24).
What is the vulnerability description for CVE-2022-40722?
CVE-2022-40722 is a misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators, which is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
How can I fix CVE-2022-40722?
To fix CVE-2022-40722, it is recommended to update PingFederate, PingID Adapter for PingFederate, and PingID Integration Kit to the latest versions available as per the vendor's documentation.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/title
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/pingidentity
- canonical/pingidentity pingfederate
- version/pingidentity pingfederate/11.1.0
- version/pingidentity pingfederate/11.1.5
- version/pingidentity pingfederate/11.2.0
- version/pingidentity pingfederate/11.2.2
- canonical/pingidentity pingid adapter for pingfederate
- canonical/pingidentity pingid integration kit