PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution
CVE-2022-23718
7.6HIGH
What is CVE-2022-23718?
PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving a sophisticated man-in-the-middle position, or to compromise Ping Identity web servers, could deliver malicious code that would be executed as SYSTEM by the PingID Windows Login application.
Affected Version(s)
PingID Windows Login Windows < 2.8
References
CVSS V3.1
Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Ping Identity credits The Commonwealth Bank of Australia for the discovery of this vulnerability.