CVE-2022-40722
High
Description
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
SeverityHigh
CVSS7.7
Exploit probability26. percentile0.3%
ProductPingidentity Pingfederate
PublishedApr 25, 2023
First seenApr 25, 2023
Weakness typeCWE-780CWE-780
How to fix
Update
- pingidentity pingid_adapter_for_pingfederate2.13.2 or later
- pingidentity pingid_integration_kit2.24 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pingidentity pingfederate | 11.1.0 ≤ v ≤ 11.1.5, 11.2.0 ≤ v ≤ 11.2.2 | — |
| pingidentity pingid_adapter_for_pingfederate | v < 2.13.2 | 2.13.2 |
| pingidentity pingid_integration_kit | v < 2.24 | 2.24 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.