A vulnerability, which was classified as critical, was found in Ping Identity PingID up to 2.7 on Windows. This affects an unknown code block of the component Local Java Service. The manipulation with an unknown input leads to a authentication bypass vulnerability. CWE is classifying the issue as CWE-288. A product requires authentication, but the product has an alternate path or channel that does not require authentication. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication.

The weakness was released 07/01/2022. The advisory is shared at docs.pingidentity.com. This vulnerability is uniquely identified as CVE-2022-23719 since 01/19/2022. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

Upgrading to version 2.8 eliminates this vulnerability.

Productinfo

Vendor

• Ping Identity

Name

• PingID

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion