CVE-2022-23720: 
Ping Identity PingID for Windows vulnerability analysis and mitigation

PingID Windows Login prior to version 2.8 contained a security vulnerability (CVE-2022-23720) related to improper privilege management. The vulnerability was disclosed on June 30, 2022, affecting PingID integration for Windows Login systems. The issue stems from the application's failure to alert or halt operation when provisioned with full permissions PingID properties file (NVD).

The vulnerability is classified under multiple CWE categories including CWE-269 (Improper Privilege Management), CWE-288 (Authentication Bypass Using an Alternate Path or Channel), and CWE-648 (Incorrect Use of Privileged APIs). The vulnerability received a CVSS v3.1 base score of 8.2 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H from NIST, while Ping Identity Corporation assessed it with a score of 7.5 (HIGH) (NVD).

If exploited, this vulnerability could allow an attacker to leverage administrator privileged PingID API credentials to perform administrative actions against PingID APIs or endpoints. The vulnerability poses a significant risk when sensitive full permissions properties files are used outside of a privileged trust boundary, potentially leading to increased exposure or discovery of privileged credentials (NVD).

The vulnerability requires local access and high privileges for exploitation. The attack complexity is considered low according to NIST's assessment, though Ping Identity Corporation rates it as high. No user interaction is required for exploitation once the attacker has the necessary access (NVD).

The vulnerability was addressed in PingID Windows Login version 2.8 and later releases. Organizations should upgrade to the latest version to mitigate this security risk (NVD).