CVE Feed

    Dashboard / CVE / CVE-2022-40722

    CVE-2022-40722

    A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.

    Published:Apr 25, 2023
    Last Modified:Feb 4, 2025
    EPS:Apr 25, 2023
    EPSS Score:0.00007
    CVSS Score:7.7

    Affected Products

    Vendor
    Pingidentity
    Product
    Pingfederate
    Vendor
    Pingidentity
    Product
    Pingid Adapter For Pingfederate
    Vendor
    Pingidentity
    Product
    Pingid Integration Kit

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-27935 (CVSS 8.6) — The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly…
    CVE-2025-26862 (CVSS 0) — Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in Ping…
    CVE-2024-22377 (CVSS 5.3) — The deploy directory in PingFederate runtime nodes is reachable to unauthorized users.…
    CVE-2024-22477 (CVSS 1.8) — A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is …
    CVE-2023-40545 (CVSS 8.8) — Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affecte…
    CVE-2023-34085 (CVSS 2.6) — When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of an…
    CVE-2023-39219 (CVSS 7.5) — PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with cra…
    CVE-2023-37283 (CVSS 8.1) — Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFed…
    CVE-2022-40724 (CVSS 6.4) — The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request For…
    CVE-2022-40723 (CVSS 6.5) — The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulne…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High