CVE-2023-40702
July 9, 2024, 6:18 p.m.
None
No Score
Description
PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate as a target user if they have existing knowledge of the target user’s first-factor credentials.
Product(s) Impacted
| Product | Versions |
|---|---|
| PingOne MFA Integration Kit |
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-290
Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Tags
Timeline
Published: July 9, 2024, 4:15 p.m.
Last Modified: July 9, 2024, 6:18 p.m.
Last Modified: July 9, 2024, 6:18 p.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
responsible-disclosure@pingidentity.com
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.