7.7
CVE-2022-40722
- EPSS 0.01%
- Veröffentlicht 25.04.2023 19:15:10
- Zuletzt bearbeitet 21.11.2024 07:21:56
- Quelle responsible-disclosure@pingide
- CVE-Watchlists
- Unerledigt
LoginA misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pingidentity ≫ Pingfederate Version >= 11.1.0 <= 11.1.5
Pingidentity ≫ Pingfederate Version >= 11.2.0 <= 11.2.2
Pingidentity ≫ Pingid Adapter For Pingfederate Version < 2.13.2
Pingidentity ≫ Pingid Integration Kit Version < 2.24
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.01% | 0.007 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.8 | 1.3 | 4 |
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
|
| responsible-disclosure@pingidentity.com | 7.7 | 1.3 | 5.8 |
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
|
CWE-327 Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
CWE-780 Use of RSA Algorithm without OAEP
The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.