7.7
CVE-2022-23723
- EPSS 0.2%
- Veröffentlicht 02.05.2022 22:15:09
- Zuletzt bearbeitet 21.11.2024 06:49:11
- Quelle responsible-disclosure@pingide
- CVE-Watchlists
- Unerledigt
LoginAn MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pingidentity ≫ Pingone Mfa Integration Kit Version1.4
Pingidentity ≫ Pingone Mfa Integration Kit Version1.4.1
Pingidentity ≫ Pingone Mfa Integration Kit Version1.5
Pingidentity ≫ Pingone Mfa Integration Kit Version1.5.1
Pingidentity ≫ Pingone Mfa Integration Kit Version1.5.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.2% | 0.423 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.7 | 3.1 | 4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
| responsible-disclosure@pingidentity.com | 7.7 | 1.3 | 5.8 |
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-288 Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.