CVE-2023-40702

PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate as a target user if they have existing knowledge of the target user’s first-factor credentials.

CVSS

No CVSS.

References

Link	Resource
https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394
https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394

Configurations

No configuration.

History

21 Nov 2024, 08:19

Type	Values Removed	Values Added
References	~~() https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394 -~~	() https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394 -
Summary		(es) El kit de integración de PingOne MFA contiene una vulnerabilidad en la que la acción skipMFA se puede configurar de modo que la autenticación del usuario no requiera la autenticación de segundo factor de los dispositivos registrados existentes del usuario. Un actor de amenazas podría aprovechar esta vulnerabilidad para autenticarse como usuario objetivo si tiene conocimiento de las credenciales de primer factor del usuario objetivo.

09 Jul 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-09 16:15

Updated : 2024-11-21 08:19

NVD link : CVE-2023-40702

Mitre link : CVE-2023-40702

CVE.ORG link : CVE-2023-40702

JSON object : View

Products Affected

No product.

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2023-40702", "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "responsible-disclosure@pingidentity.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 7.7, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "HIGH", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-07-09T16:15:03.220", "references": [{"url": "https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394", "source": "responsible-disclosure@pingidentity.com"}, {"url": "https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "responsible-disclosure@pingidentity.com", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate as a target user if they have existing knowledge of the target user\u2019s first-factor credentials."}, {"lang": "es", "value": "El kit de integraci\u00f3n de PingOne MFA contiene una vulnerabilidad en la que la acci\u00f3n skipMFA se puede configurar de modo que la autenticaci\u00f3n del usuario no requiera la autenticaci\u00f3n de segundo factor de los dispositivos registrados existentes del usuario. Un actor de amenazas podr\u00eda aprovechar esta vulnerabilidad para autenticarse como usuario objetivo si tiene conocimiento de las credenciales de primer factor del usuario objetivo."}], "lastModified": "2024-11-21T08:19:59.500", "sourceIdentifier": "responsible-disclosure@pingidentity.com"}