A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:NPingidentity Pingid Integration For Windows Login
APPPingidentity< 2.7
π΅
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
Related vulnerabilities
CVE-2022-23725HIGH7.7ten sam produkt
PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to st...
CVE-2022-23718HIGH7.6ten sam produkt
PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An ...
CVE-2022-23719HIGH7.2ten sam produkt
PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to captur...
CVE-2022-23720HIGH7.5ten sam produkt
PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full pe...
CVE-2020-25826HIGH7.8ten sam produkt
PingID Integration for Windows Login before 2.4.2 allows local users to gain privileges by modifying CefSharp....