CVE-2023-40356

July 9, 2024, 6:18 p.m.

Product(s) Impacted

PingOne MFA Integration Kit

Description

PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor authentication from the target’s existing registered devices. A threat actor might be able to exploit this vulnerability to register their own MFA device with a target user’s account if they have existing knowledge of the target user’s first factor credential.

Weaknesses

CWE-290
Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

CWE ID: 290

Date

Published: July 9, 2024, 4:15 p.m.

Last Modified: July 9, 2024, 6:18 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

responsible-disclosure@pingidentity.com

References