High severity · published May 2, 2022
CVE-2022-23723
An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow
7.7
CVSS
0.9%
EPSS
No
On KEV
Description
An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
Pingone Mfa Integration Kit · Pingidentity
1.4; 1.4.1; 1.5; 1.5.1; 1.5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23723
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23723
Release Notes
https://docs.pingidentity.com/bundle/pingfederate-pingone-mfa-ik/page/wpt1599064234202.html
Vendor Advisory
https://www.pingidentity.com/en/resources/downloads/pingfederate.html
More from Pingone Mfa Integration Kit
7.7
CVE-2023-40702
PingOne MFA Integration Kit MFA bypass
6.5
CVE-2023-39231
PingFederate PingOne MFA IK Device Pairing Second Factor Authentication Bypass