Riskcovery

CVE-2022-40722

Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.

State
Published
Severity
7.7 High
Published
Apr 25, 2023
Updated
Feb 4, 2025
Reserved
Sep 14, 2022

Read the record on cve.org

Description

A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.

Scores

CVSSScoreVectorSource
3.17.7 HighCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:NPing Identity

Weaknesses

  • CWE-780 Use of RSA Algorithm without OAEP

Affected Products

ProductVersions
PingID Adapter for PingFederatePing Identity
  • 2.13.2 to before 2.13.2Affected
PingID Integration Kit (includes PingID Adapter)Ping Identity
  • 2.24 to before 2.24Affected
PingFederate (includes PingID Adapter)Ping Identity
  • 11.1.0 to before 11.1.0*Affected
  • 11.1.5 through 11.1.5Affected
  • 11.2.0 to before 11.2.0*Affected
  • 11.2.2 through 11.2.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.