CVE-2022-23720

PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file

State: Published
Severity: 7.5 High
Published: Jun 30, 2022
Updated: Aug 3, 2024
Reserved: Jan 19, 2022

Read the record on cve.org

Description

PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID Windows Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads to an increased risk of exposure or discovery, and an attacker could leverage these credentials to perform administrative actions against PingID APIs or endpoints.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	Ping Identity

Weaknesses

CWE-648 Incorrect Use of Privileged APIs
CWE-288 Authentication Bypass Using an Alternate Path or Channel

Affected Products

Product	Versions
PingID Windows LoginPing Identity	before 2.8Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.