PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file

published 2022-06-30 4y ago modified 2026-06-17 4mo ago also EUVD-2022-28656

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 16%
public exploits: 0; none known

PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID Windows Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads to an increased risk of exposure or discovery, and an attacker could leverage these credentials to perform administrative actions against PingID APIs or endpoints.

Patch / fix

fixed in 1

Ping Identity PingID Windows Login 2.8

Is CVE-2022-23720 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	8.2	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD	2.0	4.4	AV:L/AC:M/Au:N/C:P/I:P/A:P

Affected products

Ping Identity PingID Windows Login

Classification

Weakness

CWE-648 Incorrect Use of Privileged APIs
CWE-288 Authentication Bypass Using an Alternate Path or Channel
CWE-269 Improper Privilege Management

References

pingidentity.com /en/resources/downloads/pingid.html
product, vendor-advisory
docs.pingidentity.com /bundle/pingid/page/zhy1653552428545.html
release-notes, vendor-advisory

Sources

CVE List CVE-2022-23720
NVD CVE-2022-23720

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.