CVE-2022-23721

LOW

PingID Integration for Windows Login < 2.9 - Username Collision Vulnerability

Title source: llm

Description

PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same username are provisioned onto the same machine at different times.

References (1)

Core 1

Core References

Release Notes

https://docs.pingidentity.com/r/en-us/pingid/davinci_pingid_windows_login_relnotes_2.9

Scores

CVSS v3 3.8

EPSS 0.0022

EPSS Percentile 12.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-694 CWE-74

Status published

Products (1)

pingidentity/pingid_integration_for_windows_login < 2.9

Published Apr 25, 2023

Tracked Since Feb 18, 2026