CVE-2021-42001

PingID Desktop encryption libraries misconfiguration can lead to sensitive data exposure

State: Published
Severity: 8.0 High
Published: Apr 30, 2022
Updated: Aug 4, 2024
Reserved: Oct 4, 2021

Description

PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	Ping Identity

Weaknesses

CWE-310 Cryptographic Issues

Affected Products

Product	Versions
PingID DesktopPing Identity	before 1.7.3Affected
PingID DesktopPing Identity	before 1.7.3Affected

References

https://www.pingidentity.com/en/resources/downloads/pingid.html
https://docs.pingidentity.com/bundle/pingid/page/dyt1645545885978.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.