PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:LPingidentity Pingid Integration For Windows Login
APPPingidentity< 2.8
π΅
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2022-23719HIGH7.2ten sam produkt
PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to captur...
CVE-2022-23720HIGH7.5ten sam produkt
PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full pe...
CVE-2022-23718HIGH7.6ten sam produkt
PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An ...
CVE-2021-41992HIGH7.7ten sam produkt
A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attack...
CVE-2020-25826HIGH7.8ten sam produkt
PingID Integration for Windows Login before 2.4.2 allows local users to gain privileges by modifying CefSharp....