PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file
CVE-2022-23720

7.5HIGH

Key Information:

Vendor

Ping Identity

Status
Pingid Windows Login
Vendor
CVE Published:
30 June 2022

What is CVE-2022-23720?

PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID Windows Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads to an increased risk of exposure or discovery, and an attacker could leverage these credentials to perform administrative actions against PingID APIs or endpoints.

Affected Version(s)

PingID Windows Login Windows < 2.8

References

https://www.pingidentity.com/en/resources/downloads/pingi...
x_refsource_MISC
https://docs.pingidentity.com/bundle/pingid/page/zhy16535...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ping Identity credits The Commonwealth Bank of Australia for the discovery of this vulnerability.
JSON
.