CVE-2022-23723CWE-288

PingFederate PingOneMFA Integration Kit MFA Bypass

High · published May 2, 2022

CVSS v3.1
7.7
EPSS
1%
Percentile
58.8
In the wild
Unconfirmed
What it is

An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00883 · 58.8th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2022-05-02T22:05Z
EPSS history
Timeline
  • 02 MAY 22:05Z
    PingFederate PingOneMFA Integration Kit MFA Bypass
    cvelistv5