CVE-2022-40722: Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this misconfiguration of RSA padding?
The vulnerability ID for this misconfiguration of RSA padding is CVE-2022-40722.
What is the severity of CVE-2022-40722?
The severity of CVE-2022-40722 is high with a severity value of 5.8.
What software is affected by CVE-2022-40722?
The software affected by CVE-2022-40722 includes PingFederate (version 11.1.0 to 11.1.5 and version 11.2.0 to 11.2.2), PingID Adapter for PingFederate (version up to 2.13.2), and PingID Integration Kit (version up to 2.24).
What is the vulnerability description for CVE-2022-40722?
CVE-2022-40722 is a misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators, which is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
How can I fix CVE-2022-40722?
To fix CVE-2022-40722, it is recommended to update PingFederate, PingID Adapter for PingFederate, and PingID Integration Kit to the latest versions available as per the vendor's documentation.