CVE-2021-42001

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
Ping Identity	PingID Desktop	>= unspecified, < 1.7.3
Ping Identity	PingID Desktop	>= unspecified, < 1.7.3

References

https://docs.pingidentity.com/bundle/pingid/page/dyt1645545885978.htmlRelease Notes, Vendor Advisory
https://www.pingidentity.com/en/resources/downloads/pingid.htmlPatch
https://docs.pingidentity.com/bundle/pingid/page/dyt1645545885978.htmlRelease Notes, Vendor Advisory
https://www.pingidentity.com/en/resources/downloads/pingid.htmlPatch

Timeline

Published: Apr 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-420029.8Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution.CVE-2021-420068.8An out-of-bounds access in GffLine::GffLine in gff.cpp in GCLib 0.12.7 allows an attacker to cause a segmentation fault or possibly have uns CVE-2021-420087.8The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a pro CVE-2021-420094.3An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subj CVE-2021-42019.8Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to CVE-2021-420109.8Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to versio CVE-2021-420117.8An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DL CVE-2021-420127.8A stack-based buffer overflow vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10.0 SP1 could a CVE-2021-420139.8It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to CVE-2021-420155.5A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.26), Mendix Applications using Mendix 8 (All CVE-2021-420167.5A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RU CVE-2021-420175.9A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RU