PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances
CVE-2022-23725

7.7HIGH

Key Information:

Vendor: Ping Identity
Status: Pingid Windows Login
Vendor: CVE Published:; 30 June 2022

🔔 Create Ping Identity Vulnerability Alert

What is CVE-2022-23725?

PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.

Affected Version(s)

PingID Windows Login Windows < 2.8

References

https://www.pingidentity.com/en/resources/downloads/pingi...

x_refsource_MISC

https://docs.pingidentity.com/bundle/pingid/page/zhy16535...

x_refsource_MISC

CVSS V3.1

Score:

7.7

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Local

Attack Complexity:

High

Privileges Required:

Low

User Interaction:

None

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 30, 2022
Vulnerability Reserved
Jan 19, 2022

Credit

Ping Identity credits The Commonwealth Bank of Australia for the discovery of this vulnerability.

JSON