CVE-2022-23723 PingFederate PingOneMFA Integration Kit MFA Bypass
Attackers can bypass Multi-Factor Authentication in PingFederate when using specific adapter HTML templates during authentication flows.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-23723?
CVE-2022-23723 is a high-severity authentication bypass vulnerability in PingFederate PingOne MFA Integration Kit, published on 2 May 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow.
Which versions are affected by CVE-2022-23723?
It affects 1 product.
Products include Pingidentity Pingone Mfa Integration Kit.
How do I fix CVE-2022-23723?
No fix has been published for CVE-2022-23723 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-23723 being exploited?
There is no known exploitation of CVE-2022-23723 in the wild and no public exploit code.
Other vulnerabilities in PingFederate PingOne MFA Integration Kit
Sources
Also known as GHSA-hmwv-wmm7-qrjr.