What is the CVSS score of CVE-2022-23719?

CVE-2022-23719 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Java CVE-2022-23719

MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2022-06-30 responsible-disclosure@pingidentity.com

Denial Of Service Java Microsoft Pingid Integration For Windows Login

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 30, 2022 - 20:15 nvd

MEDIUM 6.4

DescriptionNVD

PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication.

AnalysisAI

PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. Rated medium severity (CVSS 6.4). No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-288. PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication. Affected products include: Pingidentity Pingid Integration For Windows Login. Version information: prior to 2.8.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.