mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-07 05:28:59 +00:00
133 lines
4.0 KiB
JSON
133 lines
4.0 KiB
JSON
{
|
|
"id": "CVE-2022-40722",
|
|
"sourceIdentifier": "responsible-disclosure@pingidentity.com",
|
|
"published": "2023-04-25T19:15:10.240",
|
|
"lastModified": "2023-05-04T19:46:42.447",
|
|
"vulnStatus": "Analyzed",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "HIGH",
|
|
"privilegesRequired": "HIGH",
|
|
"userInteraction": "NONE",
|
|
"scope": "CHANGED",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 5.8,
|
|
"baseSeverity": "MEDIUM"
|
|
},
|
|
"exploitabilityScore": 1.3,
|
|
"impactScore": 4.0
|
|
},
|
|
{
|
|
"source": "responsible-disclosure@pingidentity.com",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "HIGH",
|
|
"privilegesRequired": "HIGH",
|
|
"userInteraction": "NONE",
|
|
"scope": "CHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 7.7,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"exploitabilityScore": 1.3,
|
|
"impactScore": 5.8
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-327"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"source": "responsible-disclosure@pingidentity.com",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-780"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "11.1.0",
|
|
"versionEndIncluding": "11.1.5",
|
|
"matchCriteriaId": "4F085AB7-29E3-4CC6-88C6-49EF87B1E7E9"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "11.2.0",
|
|
"versionEndIncluding": "11.2.2",
|
|
"matchCriteriaId": "2F76BB82-2AE0-4330-84E7-BBFFABF030C0"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:pingidentity:pingid_adapter_for_pingfederate:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "2.13.2",
|
|
"matchCriteriaId": "9285EE82-E2F6-4C82-8F0E-2149B8652E71"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:pingidentity:pingid_integration_kit:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "2.24",
|
|
"matchCriteriaId": "A0D3BE72-98EE-4FE4-BF80-CDD66F495AC1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa",
|
|
"source": "responsible-disclosure@pingidentity.com",
|
|
"tags": [
|
|
"Product"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_20_rn",
|
|
"source": "responsible-disclosure@pingidentity.com",
|
|
"tags": [
|
|
"Release Notes"
|
|
]
|
|
}
|
|
]
|
|
} |