CVE-2022-23724 PingID Integration for Windows Login MFA Bypass
Attackers with compromised credentials can bypass MFA and take over accounts due to static encryption keys in PingID Windows Login integration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-23724?
CVE-2022-23724 is a medium-severity vulnerability in PingID Integration for Windows Login, published on 4 May 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials.
Which versions are affected by CVE-2022-23724?
It affects 1 product.
Products include Pingidentity Pingid Integration for Windows Login.
How do I fix CVE-2022-23724?
No fix has been published for CVE-2022-23724 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-23724 being exploited?
There is no known exploitation of CVE-2022-23724 in the wild and no public exploit code.
Other vulnerabilities in PingID Integration for Windows Login
- CVE-2020-25826 Privilege escalation in n/a
- CVE-2022-23725 Information disclosure in PingID Windows Login
- CVE-2021-41992 PingID Windows Login RSA cryptographic weakness with possible offline MFA bypass
- CVE-2022-23718 PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution
- CVE-2022-23720 Hardcoded credentials in PingID Windows Login
Sources
Also known as GHSA-6925-q744-qcx6.