CVE-2022-40723

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-305 CWE-287

Affected software

Vendor	Product	Versions
Ping Identity	PingID Radius PCV	2.10.0; >= 3.0.0, < 3.0.0*; >= 3.0.2, <= 3.0.2
Ping Identity	PingID Integration Kit (includes Radius PCV)	>= 2.24, < 2.24
Ping Identity	PingFederate (includes Radius PCV)	>= 11.1.0, < 11.1.0; >= 11.1.5, <= 11.1.5; >= 11.2.0, < 11.2.0; >= 11.2.2, <= 11.2.2

References

https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_19_rnRelease Notes
https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_19_rnRelease Notes

Timeline

Published: Apr 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-407248.8The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GE CVE-2022-407256.1PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts CVE-2022-407327.5An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Wind CVE-2022-407336.5An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Wind CVE-2022-407346.5UniSharp laravel-filemanager (aka Laravel Filemanager) before 2.6.4 allows download?working_dir=%2F.. directory traversal to read arbitrary CVE-2022-407357.5The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, beca CVE-2022-407366.5An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in AP4_CttsAtom::Create in Core/Ap4CttsAtom.cpp.CVE-2022-407376.5An issue was discovered in Bento4 through 1.6.0-639. A buffer over-read exists in the function AP4_StdcFileByteStream::WritePartial located CVE-2022-407386.5An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_DescriptorListWriter::Action in Core/Ap4Descri CVE-2022-407395.4Ragic report generation page has insufficient filtering for special characters. A remote attacker with general user privilege can inject Jav CVE-2022-407407.2Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this CVE-2022-407419.8Mail SQR Expert’s specific function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this v