CVE-2022-23720 Hardcoded credentials in PingID Windows Login

What is CVE-2022-23720?

CVE-2022-23720 is a high-severity vulnerability in PingID Windows Login, published on 30 Jun 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID Windows Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads to an increased risk of exposure or discovery, and an attacker could leverage these credentials to perform administrative actions against PingID APIs or endpoints.

Weakness: CWE-648, CWE-269, CWE-288

Which versions are affected by CVE-2022-23720?

It affects 1 product.

Products include Pingidentity Pingid Integration for Windows Login.

How do I fix CVE-2022-23720?

No fix has been published for CVE-2022-23720 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-23720 being exploited?

There is no known exploitation of CVE-2022-23720 in the wild and no public exploit code.

Other vulnerabilities in PingID Windows Login

• CVE-2020-25826 Privilege escalation in n/a High 7.8
• CVE-2022-23725 Information disclosure in PingID Windows Login High 7.7
• CVE-2021-41992 PingID Windows Login RSA cryptographic weakness with possible offline MFA bypass High 7.7
• CVE-2022-23718 PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution High 7.6
• CVE-2022-23719 Missing authorization in PingID Windows Login High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-79g3-7482-2jvc.