CVE-2022-23718

Description

PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving a sophisticated man-in-the-middle position, or to compromise Ping Identity web servers, could deliver malicious code that would be executed as SYSTEM by the PingID Windows Login application.

Weakness classification

• responsible-disclosure@pingidentity.com: CWE-1352
• nvd@nist.gov: NVD-CWE-Other

Primary references

• responsible-disclosure@pingidentity.com — Release Notes, Vendor Advisory
• responsible-disclosure@pingidentity.com — Product, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Product, Vendor Advisory