CVE-2022-23720
Assigner: Ping Identity
Published: 2022-06-30T19:25:41
State: PUBLISHED
affected: platforms: Windows
product: PingID Windows Login
vendor: Ping Identity
versions: lessThan: 2.8
status: affected
version: unspecified
versionType: custom
credits: value: Ping Identity credits The Commonwealth Bank of Australia for the discovery of this vulnerability.
descriptions: value: PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID Windows Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads to an increased risk of exposure or discovery, and an attacker could leverage these credentials to perform administrative actions against PingID APIs or endpoints.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-648
description: CWE-648 Incorrect Use of Privileged APIs
type: CWE
descriptions: cweId: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
type: CWE
source: advisory: SECADV031
discovery: EXTERNAL
title: PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file