« Volver al listado

CVE-2022-23722

Estado: ModificadaMedia (6.5)—

When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pingidentity — Pingfederate

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-23722",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "responsible-disclosure@pingidentity.com",
      "affectedData": [
        {
          "vendor": "Ping Identity",
          "product": "PingFederate",
          "versions": [
            {
              "status": "affected",
              "version": "11.0",
              "versionType": "custom",
              "lessThanOrEqual": "11.0"
            },
            {
              "status": "affected",
              "version": "10.3",
              "versionType": "custom",
              "lessThanOrEqual": "10.3.4"
            },
            {
              "status": "affected",
              "version": "10.2",
              "versionType": "custom",
              "lessThanOrEqual": "10.2.7"
            },
            {
              "status": "affected",
              "version": "10.1",
              "versionType": "custom",
              "lessThanOrEqual": "10.1.9"
            },
            {
              "status": "affected",
              "version": "10.0",
              "versionType": "custom",
              "lessThanOrEqual": "10.0.12"
            },
            {
              "status": "affected",
              "version": "9.3",
              "versionType": "custom",
              "lessThanOrEqual": "9.3.3P16"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-05-02T22:15:09.647",
  "references": [
    {
      "url": "https://docs.pingidentity.com/bundle/pingfederate-110/page/spk1642790928508.html",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "responsible-disclosure@pingidentity.com"
    },
    {
      "url": "https://www.pingidentity.com/en/resources/downloads/pingfederate.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "responsible-disclosure@pingidentity.com"
    },
    {
      "url": "https://docs.pingidentity.com/bundle/pingfederate-110/page/spk1642790928508.html",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.pingidentity.com/en/resources/downloads/pingfederate.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "responsible-disclosure@pingidentity.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password."
    },
    {
      "lang": "es",
      "value": "Cuando un mecanismo de restablecimiento de contraseña está configurado para usar la API de Autenticación con una Política de Autenticación, una Contraseña de Una sola vez por correo electrónico, PingID o autenticación por SMS, un usuario existente puede restablecer la contraseña de otro usuario existente"
    }
  ],
  "lastModified": "2026-06-17T04:30:42.220",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF59C274-0837-41EF-BD03-B2C762B8AD2E",
              "versionEndExcluding": "9.3.3",
              "versionStartIncluding": "9.3.0"
            },
            {
              "criteria": "cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C32AD2C-6B70-49E0-B4C1-829735EDBA35",
              "versionEndExcluding": "10.0.12",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23194E8C-C2BD-4A0C-875D-BBF15679A0F1",
              "versionEndExcluding": "10.1.9",
              "versionStartIncluding": "10.1.0"
            },
            {
              "criteria": "cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0887EB34-CD7F-4A26-AEC5-DCC5DA07E795",
              "versionEndExcluding": "10.2.7",
              "versionStartIncluding": "10.2.0"
            },
            {
              "criteria": "cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC079534-00BB-4965-88F1-D8FDF79FF35C",
              "versionEndExcluding": "10.3.4",
              "versionStartIncluding": "10.3.0"
            },
            {
              "criteria": "cpe:2.3:a:pingidentity:pingfederate:9.3.3:p15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "742ABDC8-3F6F-4D21-9FFE-BDF5F098FD60"
            },
            {
              "criteria": "cpe:2.3:a:pingidentity:pingfederate:11.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E04A442B-5726-4057-B6B3-7BB6021255AC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "responsible-disclosure@pingidentity.com"
}