CVE-2022-23718 PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution

What is CVE-2022-23718?

CVE-2022-23718 is a high-severity vulnerability in PingID Windows Login, published on 30 Jun 2022.

Official description

PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving a sophisticated man-in-the-middle position, or to compromise Ping Identity web servers, could deliver malicious code that would be executed as SYSTEM by the PingID Windows Login application.

Weakness: CWE-1352

Which versions are affected by CVE-2022-23718?

It affects 1 product.

Products include Pingidentity Pingid Integration for Windows Login.

How do I fix CVE-2022-23718?

No fix has been published for CVE-2022-23718 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-23718 being exploited?

There is no known exploitation of CVE-2022-23718 in the wild and no public exploit code.

Other vulnerabilities in PingID Windows Login

• CVE-2020-25826 Privilege escalation in n/a High 7.8
• CVE-2022-23725 Information disclosure in PingID Windows Login High 7.7
• CVE-2021-41992 PingID Windows Login RSA cryptographic weakness with possible offline MFA bypass High 7.7
• CVE-2022-23720 Hardcoded credentials in PingID Windows Login High 7.5
• CVE-2022-23719 Missing authorization in PingID Windows Login High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-79r2-xx5c-vqfx.