CVE-2022-23725CWE-288CWE-522

PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances

High · published June 30, 2022

CVSS v3.1
7.7
EPSS
0%
Percentile
11.1
In the wild
Unconfirmed
What it is

PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00214 · 11.1th percentile
Weaknesses
CWE-288 · Authentication Bypass Using an Alternate Path or Channel; CWE-522 · Insufficiently Protected Credentials
Published
2022-06-30T19:25Z
EPSS history
Timeline
  • 30 JUN 19:25Z
    PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances
    cvelistv5