Medium severity · published Apr 25, 2023
CVE-2022-40723
Configuration-based MFA Bypass in PingID RADIUS PCV.
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
PingFederate (includes Radius PCV) · Ping Identity
11.1.0 before 11.1.0*; 11.1.5 through 11.1.5; 11.2.0 before 11.2.0*; 11.2.2 through 11.2.2 · source: vendor
PI
PingID Integration Kit (includes Radius PCV) · Ping Identity
2.24 before 2.24 · source: vendor
PR
PingID Radius PCV · Ping Identity
2.10.0; 3.0.0 before 3.0.0*; 3.0.2 through 3.0.2 · source: vendor
PI
Pingfederate · Pingidentity
11.1.0 through 11.1.5; 11.2.0 through 11.2.2 · source: NVD
PI
Pingid Integration Kit · Pingidentity
before 2.24 · source: NVD
RP
Radius Pcv · Pingidentity
3.0.0 before 3.0.2; 2.10.0 · source: NVD
Affected product
PI
PingFederate (includes Radius PCV)
Ping Identity