PingID Desktop encryption libraries misconfiguration can lead to sensitive data exposure
CVE-2021-42001

8HIGH

Key Information:

Vendor: Ping Identity
Status: Pingid Desktop
Vendor: CVE Published:; 30 April 2022

🔔 Create Ping Identity Vulnerability Alert

What is CVE-2021-42001?

PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP.

Affected Version(s)

PingID Desktop macOS X < 1.7.3

PingID Desktop Windows < 1.7.3

References

https://www.pingidentity.com/en/resources/downloads/pingi...

x_refsource_MISC

https://docs.pingidentity.com/bundle/pingid/page/dyt16455...

x_refsource_MISC

CVSS V3.1

Score:

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

High

User Interaction:

None

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 30, 2022
Vulnerability Reserved
Oct 4, 2021

Credit

Ping Identity credits The Commonwealth Bank of Australia for the discovery of this vulnerability.