CVEvulnerability
CVE-2021-42001
9.9 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-04-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.0 HIGH — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-310
Description
PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP.
Affected configurations
• pingidentity pingid desktop (< 1.7.3)
Related
Weakness · not in database (1)
References
- https://docs.pingidentity.com/bundle/pingid/page/dyt1645545885978.html Release Notes, Vendor Advisory
- https://www.pingidentity.com/en/resources/downloads/pingid.html Patch
- https://docs.pingidentity.com/bundle/pingid/page/dyt1645545885978.html Release Notes, Vendor Advisory
- https://www.pingidentity.com/en/resources/downloads/pingid.html Patch