What is the vulnerability ID for this misconfiguration of RSA padding?

The vulnerability ID for this misconfiguration of RSA padding is CVE-2022-40722.

What is the severity of CVE-2022-40722?

The severity of CVE-2022-40722 is high with a severity value of 5.8.

What software is affected by CVE-2022-40722?

The software affected by CVE-2022-40722 includes PingFederate (version 11.1.0 to 11.1.5 and version 11.2.0 to 11.2.2), PingID Adapter for PingFederate (version up to 2.13.2), and PingID Integration Kit (version up to 2.24).

How can I fix CVE-2022-40722?

To fix CVE-2022-40722, it is recommended to update PingFederate, PingID Adapter for PingFederate, and PingID Integration Kit to the latest versions available as per the vendor's documentation.

Vulnerability/
CVE-2022-40722

high

7.7

CWE

327 780

25/4/2023

4/5/2023

CVE-2022-40722

Q: What is the vulnerability description for CVE-2022-40722?

CVE-2022-40722 is a misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators, which is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.

First published: Tue Apr 25 2023(Updated: )

A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.

Credit: responsible-disclosure@pingidentity.com

Affected Software	Affected Version	How to fix
Pingidentity Pingfederate	>=11.1.0<=11.1.5
Pingidentity Pingfederate	>=11.2.0<=11.2.2
Pingidentity Pingid Adapter For Pingfederate	<2.13.2
Pingidentity Pingid Integration Kit	<2.24

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the vulnerability ID for this misconfiguration of RSA padding?
The vulnerability ID for this misconfiguration of RSA padding is CVE-2022-40722.
What is the severity of CVE-2022-40722?
The severity of CVE-2022-40722 is high with a severity value of 5.8.
What software is affected by CVE-2022-40722?
The software affected by CVE-2022-40722 includes PingFederate (version 11.1.0 to 11.1.5 and version 11.2.0 to 11.2.2), PingID Adapter for PingFederate (version up to 2.13.2), and PingID Integration Kit (version up to 2.24).
What is the vulnerability description for CVE-2022-40722?
CVE-2022-40722 is a misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators, which is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
How can I fix CVE-2022-40722?
To fix CVE-2022-40722, it is recommended to update PingFederate, PingID Adapter for PingFederate, and PingID Integration Kit to the latest versions available as per the vendor's documentation.

collector/nvd-index
agent/severity
agent/references
agent/weakness
agent/author
agent/description
agent/tags
agent/type
agent/event
vendor/pingidentity
canonical/pingidentity pingfederate
version/pingidentity pingfederate/11.1.0
version/pingidentity pingfederate/11.1.5
version/pingidentity pingfederate/11.2.0
version/pingidentity pingfederate/11.2.2
canonical/pingidentity pingid adapter for pingfederate
canonical/pingidentity pingid integration kit

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.