CVE-2022-23722

When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.

Score

CVSS 3.1 6.5 Medium

Status

Modified - responsible-disclosure@pingidentity.com

Published

2022-05-02

Last modified

2024-08-03

Weaknesses

CWE-287, CWE-288

Affected products

• Pingfederate (Ping Identity)
• Pingfederate (Pingidentity)

References

• https://docs.pingidentity.com/bundle/pingfederate-110/page/spk1642790928508.html
• https://www.pingidentity.com/en/resources/downloads/pingfederate.html