Medium severity · published Jun 30, 2022
CVE-2022-23725
PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PW
PingID Windows Login · Ping Identity
before 2.8 · source: vendor
PI
Pingid Integration For Windows Login · Pingidentity
before 2.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23725
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23725
Vendor Advisory
https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.html
Vendor Advisory
https://www.pingidentity.com/en/resources/downloads/pingid.html
More from PingID Windows Login
8.2
CVE-2022-23720
PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file
8.1
CVE-2022-23718
PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution
6.4
CVE-2022-23719
PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests
5.5
CVE-2022-23717
PingID Windows Login prior to 2.8 denial of service condition