CVE-2022-23722 - PingFederate Password Reset via Authentication API Mishandling

Back Back to CVE browser

MEDIUM

PingFederate Password Reset via Authentication API Mishandling

Published May 2, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 0.61%

Description

When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.

Affected products

Vendor Ping Identity Product PingFederate Default
n/a
- Version
  10.0
  Status
  affected
  Constraints
  <=10.0.12
- Version
  10.1
  Status
  affected
  Constraints
  <=10.1.9
- Version
  10.2
  Status
  affected
  Constraints
  <=10.2.7
- Version
  10.3
  Status
  affected
  Constraints
  <=10.3.4
- Version
  11.0
  Status
  affected
  Constraints
  <=11.0
- Version
  9.3
  Status
  affected
  Constraints
  <=9.3.3P16

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ping Identity

PingFederate

n/a

Version	Status	Constraints
10.0	affected	<=10.0.12
10.1	affected	<=10.1.9
10.2	affected	<=10.2.7
10.3	affected	<=10.3.4
11.0	affected	<=11.0
9.3	affected	<=9.3.3P16

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-287

Improper Authentication

CWE-288

References (2)

https://docs.pingidentity.com/bundle/pingfederate-110/page/spk1642790928508.html
x_refsource_MISCRelease NotesVendor Advisory
https://www.pingidentity.com/en/resources/downloads/pingfederate.html
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://docs.pingidentity.com/bundle/pingfederate-110/page/spk1642790928508.html		x_refsource_MISCRelease NotesVendor Advisory
https://www.pingidentity.com/en/resources/downloads/pingfederate.html		x_refsource_MISCVendor Advisory