CVE-2022-23726

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-732

Affected software

Vendor	Product	Versions
Ping Identity	PingCentral	>= 1.10, < 1.10; >= 1.9, < 1.9.3; >= 1.8, < 1.8.4

References

https://docs.pingidentity.com/bundle/pingcentral-110/page/sdd1651696160285.htmlRelease Notes, Vendor Advisory
https://www.pingidentity.com/en/resources/downloads/pingcentral.htmlProduct
https://docs.pingidentity.com/bundle/pingcentral-110/page/sdd1651696160285.htmlRelease Notes, Vendor Advisory
https://www.pingidentity.com/en/resources/downloads/pingcentral.htmlProduct

Timeline

Published: Sep 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-237277.8There is a privilege escalation vulnerability in some webOS TVs. Due to wrong setting environments, local attacker is able to perform specif CVE-2022-237286.1Attacker can reset the device with AT Command in the process of rebooting the device. The LG ID is LVE-SMP-210011.CVE-2022-237297.8When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010.CVE-2022-23735.3The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users CVE-2022-237309.8The public API error causes for the attacker to be able to bypass API access control.CVE-2022-237317.8V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models.CVE-2022-237328.8A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections. Th CVE-2022-237335.4A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes. This injection was CVE-2022-237348.8A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code exec CVE-2022-237376.5An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to cre CVE-2022-237385.7An improper cache key vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to access private reposito CVE-2022-237399.8An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API re