CVE-2022-23726 : PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authenticat

PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information.

Published 2022-09-30 15:15:09

Updated 2022-10-04 16:33:40

Source Ping Identity Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2022-23726

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 27 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-23726

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	1.2	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.4	MEDIUM	CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N	1.0	4.0	Ping Identity Corporation
Attack Vector: Adjacent Network Attack Complexity: High Privileges Required: High User Interaction: None Scope: Changed Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2022-23726

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: responsible-disclosure@pingidentity.com (Secondary)

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-23726

Products affected by CVE-2022-23726

Pingidentity » Pingcentral
Versions from including (>=) 1.9 and before (<) 1.9.3
cpe:2.3:a:pingidentity:pingcentral:*:*:*:*:*:*:*:*
Matching versions
Pingidentity » Pingcentral
Versions from including (>=) 1.8 and before (<) 1.8.4
cpe:2.3:a:pingidentity:pingcentral:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2022-23726

Exploit prediction scoring system (EPSS) score for CVE-2022-23726

CVSS scores for CVE-2022-23726

CWE ids for CVE-2022-23726

References for CVE-2022-23726

Products affected by CVE-2022-23726