CVE-2022-40723 — Configuration-based MFA Bypass in PingID RADIUS PCV.

Description (CNA)

The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.

Affected (CNA)

Vendor / product	Versions
Ping Identity / PingID Radius PCV	affected 2.10.0; affected 3.0.0 before 3.0.0*; affected 3.0.2 through 3.0.2
Ping Identity / PingID Integration Kit (includes Radius PCV)	affected 2.24 before 2.24
Ping Identity / PingFederate (includes Radius PCV)	affected 11.1.0 before 11.1.0; affected 11.1.5 through 11.1.5; affected 11.2.0 before 11.2.0; affected 11.2.2 through 11.2.2

CWE

CWE-305

References

https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_19_rn

ADP enrichment

CVE

No English description supplied.

https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_19_rn

CISA-ADP

No English description supplied.

No references supplied.