CVE-2022-23718

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving a sophisticated man-in-the-middle position, or to compromise Ping Identity web servers, could deliver malicious code that would be executed as SYSTEM by the PingID Windows Login application.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1352

Affected software

Vendor	Product	Versions
Ping Identity	PingID Windows Login	>= unspecified, < 2.8

References

https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.htmlRelease Notes, Vendor Advisory
https://www.pingidentity.com/en/resources/downloads/pingid.htmlProduct, Vendor Advisory
https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.htmlRelease Notes, Vendor Advisory
https://www.pingidentity.com/en/resources/downloads/pingid.htmlProduct, Vendor Advisory

Timeline

Published: Jun 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-237196.4PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An at CVE-2022-23724.8The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2022-237208.2PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties fi CVE-2022-237213.3PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two peopl CVE-2022-237226.5When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID o CVE-2022-237237.7An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authen CVE-2022-237248.1Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypasse CVE-2022-237255.5PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under s CVE-2022-237264.9PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amo CVE-2022-237277.8There is a privilege escalation vulnerability in some webOS TVs. Due to wrong setting environments, local attacker is able to perform specif CVE-2022-237286.1Attacker can reset the device with AT Command in the process of rebooting the device. The LG ID is LVE-SMP-210011.CVE-2022-237297.8When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010.