CVE-2022-23720

PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID Windows Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads to an increased risk of exposure or discovery, and an attacker could leverage these credentials to perform administrative actions against PingID APIs or endpoints.

• CWE-288
• CWE-648
• CWE-269

• https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.htmlRelease Notes, Vendor Advisory
• https://www.pingidentity.com/en/resources/downloads/pingid.htmlProduct, Vendor Advisory
• https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.htmlRelease Notes, Vendor Advisory
• https://www.pingidentity.com/en/resources/downloads/pingid.htmlProduct, Vendor Advisory

Published

Jun 30, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23715A flaw was discovered in ECE before 3.4.0 that might lead to…6.5
• CVE-2022-23716A flaw was discovered in ECE before 3.1.1 that could lead to…5.3
• CVE-2022-23717PingID Windows Login prior to 2.8 is vulnerable to a denial …5.5
• CVE-2022-23718PingID Windows Login prior to 2.8 uses known vulnerable comp…8.1
• CVE-2022-23719PingID Windows Login prior to 2.8 does not authenticate comm…6.4
• CVE-2022-2372The YaySMTP WordPress plugin before 2.2.2 does not sanitise …4.8
• CVE-2022-23721PingID integration for Windows login prior to 2.9 does not h…3.3
• CVE-2022-23722When a password reset mechanism is configured to use the Aut…6.5
• CVE-2022-23723An MFA bypass vulnerability exists in the PingFederate PingO…7.7
• CVE-2022-23724Use of static encryption key material allows forging an auth…8.1
• CVE-2022-23725PingID Windows Login prior to 2.8 does not properly set perm…5.5
• CVE-2022-23726PingCentral versions prior to listed versions expose Spring …4.9