What is CVE-2022-23720?

CVE-2022-23720 is a high-severity vulnerability in Ping Identity Pingid Windows Login, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 7.5/10. Published 2022-06-30.

How severe is CVE-2022-23720?

High severity. CVSS v3 base score is 7.5 out of 10.

Privilege escalation in Ping Identity Pingid Windows Login

CVE-2022-23720

PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, su…

EPSS: 0.002 (15.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Ping Identity Pingid Windows Login — versions unspecified
Pingidentity Pingid_integration_for_windows_login

Weakness classification (CWE)

References

responsible-disclosure@pingidentity.com (Product, x_refsource_MISC, Vendor Advisory)
responsible-disclosure@pingidentity.com (x_refsource_MISC, Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2022-23720?: CVE-2022-23720 is a high-severity vulnerability in Ping Identity Pingid Windows Login, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 7.5/10. Published 2022-06-30.
How severe is CVE-2022-23720?: High severity. CVSS v3 base score is 7.5 out of 10.