CVE-2023-39231: PingFederate PingOne MFA IK Device Pairing Second Factor Authentication Bypass
First published: Tue Oct 24 2023(Updated: )
PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's first factor credentials.
Credit: responsible-disclosure@pingidentity.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pingidentity Pingone Mfa Integration Kit | =2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this PingFederate vulnerability?
The vulnerability ID for this PingFederate vulnerability is CVE-2023-39231.
What is the title of this vulnerability?
The title of this vulnerability is 'PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device'.
What is the severity of CVE-2023-39231?
The severity of CVE-2023-39231 is high with a severity value of 6.5.
How does the vulnerability in PingFederate occur?
The vulnerability in PingFederate occurs due to the PingOne MFA adapter allowing a new MFA device to be paired without requiring second factor authentication from an existing registered device.
How can a threat actor exploit this vulnerability in PingFederate?
A threat actor can exploit this vulnerability in PingFederate by registering their own MFA device if they have knowledge of a victim user's first factor authentication.
Is there a fix available for CVE-2023-39231?
Yes, patches have been released by PingIdentity to address this vulnerability.
Where can I find more information about CVE-2023-39231?
You can find more information about CVE-2023-39231 at the following references: [Reference 1](https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394) and [Reference 2](https://www.pingidentity.com/en/resources/downloads/pingid.html).
- collector/nvd-api
- agent/weakness
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/severity
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/pingidentity
- canonical/pingidentity pingone mfa integration kit
- version/pingidentity pingone mfa integration kit/2.2