Medium severity · published Apr 25, 2023
CVE-2022-40722
Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.
5.8
CVSS
0.3%
EPSS
No
On KEV
Description
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
PingFederate (includes PingID Adapter) · Ping Identity
11.1.0 before 11.1.0*; 11.1.5 through 11.1.5; 11.2.0 before 11.2.0*; 11.2.2 through 11.2.2 · source: vendor
PA
PingID Adapter for PingFederate · Ping Identity
2.13.2 before 2.13.2 · source: vendor, NVD
PI
PingID Integration Kit (includes PingID Adapter) · Ping Identity
2.24 before 2.24 · source: vendor
PI
Pingfederate · Pingidentity
11.1.0 through 11.1.5; 11.2.0 through 11.2.2 · source: NVD
PI
Pingid Integration Kit · Pingidentity
before 2.24 · source: NVD
Affected product
PI
PingFederate (includes PingID Adapter)
Ping Identity