CVE-2022-23720
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedPingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID Windows Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads to an increased risk of exposure or discovery, and an attacker could leverage these credentials to perform administrative actions against PingID APIs or endpoints.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidencePingID Windows Login prior to version 2.8 lacks validation to detect when it has been provisioned with full-privilege PingID properties files (typically reserved for PingFederate server-side use). This allows administrator-level API credentials to be deployed to user endpoints, exposing high-privilege credentials outside their intended privileged trust boundary and enabling attackers to perform administrative actions against PingID APIs.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 2.8CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Local
- Complexity
- Low
- Privileges
- High
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check installed PingID Windows Login versionOpen Control Panel > Programs and Features, or use PowerShell: Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object {$_.DisplayName -like '*PingID*'} | Select-Object DisplayName, DisplayVersionAffected if The installed version is earlier than 2.8
-
Locate PingID properties files on the endpointSearch for files named 'pingid.properties' or similar configuration files in typical installation directories such as 'C:\Program Files\PingID\' or 'C:\ProgramData\PingID\'Affected if A pingid.properties file exists on the system
-
Identify properties file type and privilege levelExamine the properties file contents for indicators of full-privilege server-side configuration. Look for admin-level API credentials, 'admin' or 'server' indicators in credential fields, or properties typically found in PingFederate server configurations versus client/user configurationsAffected if The properties file contains full-privilege administrative credentials or server-level configuration meant for PingFederate rather than client-level credentials
-
Verify credential deployment contextConfirm whether the machine is a regular user endpoint or a PingFederate server. Check system purpose and whether administrative API credentials are needed on this specific machineAffected if Administrative-level credentials from full-privilege properties files are deployed to a standard user workstation rather than a privileged server
You are affected if PingID Windows Login version is below 2.8 AND full-privilege PingID properties files containing administrator-level API credentials are deployed to user endpoints instead of only being used on PingFederate servers.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped2.8
Upgrade PingID Windows Login to version 2.8 or later, which adds alerting/halt mechanisms for improper credential provisioning. Additionally, audit all deployments to ensure full-permission properties files are only used in privileged server contexts and not user endpoints.
2.8
- Verify current installed version of PingID Windows Login
- Download PingID Windows Login version 2.8 or later from the official PingIdentity download portal
- Review upgrade documentation at docs.pingidentity.com for version 2.8 upgrade procedures
- Ensure proper PingID properties file with user-level permissions (not full/administrator permissions) is prepared before upgrade
- Perform upgrade following standard PingID Windows Login installation procedures
- After upgrade, verify that the application properly handles and rejects full permissions properties files
- Confirm credentials deployed match user endpoint requirements, not administrator/PingFederate-level credentials
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation8.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2022-23720 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2022-23720 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data