Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2022-40722

Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Ping Identity

Description

A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Ping Identity PingID Adapter for PingFederate

  • 2.13.2 to < 2.13.2affected

Ping Identity PingID Integration Kit (includes PingID Adapter)

  • 2.24 to < 2.24affected

Ping Identity PingFederate (includes PingID Adapter)

  • 11.1.0 to < 11.1.0*affected
  • 11.1.5 to ≤ 11.1.5affected
  • 11.2.0 to < 11.2.0*affected
  • 11.2.2 to ≤ 11.2.2affected

References