PingID iOS mobile application prior to 1.19 vulnerable to pre-computed dictionary attacks
CVE-2021-41994

6.6MEDIUM

Key Information:

Vendor: Ping Identity
Status: Pingid Mobile Application
Vendor: CVE Published:; 30 April 2022

🔔 Create Ping Identity Vulnerability Alert

What is CVE-2021-41994?

A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.

Affected Version(s)

PingID Mobile Application iOS < 1.19

References

https://www.pingidentity.com/en/resources/downloads/pingi...

x_refsource_MISC

https://docs.pingidentity.com/bundle/pingid/page/ejd16420...

x_refsource_MISC

CVSS V3.1

Score:

6.6

Severity:

MEDIUM

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Physical

Attack Complexity:

High

Privileges Required:

High

User Interaction:

None

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 30, 2022
Vulnerability Reserved
Oct 4, 2021

Credit

Ping Identity credits The Commonwealth Bank of Australia for the discovery of this vulnerability.