CVE-2022-40723

Configuration-based MFA Bypass in PingID RADIUS PCV.

State: Published
Severity: 6.5 Medium
Published: Apr 25, 2023
Updated: Feb 4, 2025
Reserved: Sep 14, 2022

Description

The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:H/RL:U/RC:C	Ping Identity

Weaknesses

CWE-305 Authentication Bypass by Primary Weakness

Affected Products

Product	Versions
PingID Radius PCVPing Identity	2.10.0Affected 3.0.0 to before 3.0.0*Affected 3.0.2 through 3.0.2Affected
PingID Integration Kit (includes Radius PCV)Ping Identity	2.24 to before 2.24Affected
PingFederate (includes Radius PCV)Ping Identity	11.1.0 to before 11.1.0Affected 11.1.5 through 11.1.5Affected 11.2.0 to before 11.2.0Affected 11.2.2 through 11.2.2Affected

References

https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_19_rn

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.