The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPingidentity Pingfederate
APPPingidentity< 10.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2023-40545HIGH8.8ten sam produkt
Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affecte...
CVE-2023-39219HIGH7.5ten sam produkt
PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with cra...
CVE-2023-37283HIGH8.1ten sam produkt
Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFed...
CVE-2022-40722HIGH7.7ten sam produkt
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA wi...
CVE-2021-41770HIGH7.5ten sam produkt
Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can ...