Lucene search

[email protected]CVE-2022-40724

HistoryApr 25, 2023 - 7:15 p.m.

CVE-2022-40724

2023-04-2519:15:10

CWE-352

[email protected]

web.nvd.nist.gov

cve-2022-40724

pingfederate

local identity profiles

csrf

get requests

vulnerability

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.7%

JSON

The PingFederate Local Identity Profiles ‘/pf/idprofile.ping’ endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.

Affected configurations

NVD

Node

pingidentitypingfederateRange10.3.0–10.3.11

pingidentitypingfederateRange11.0.0–11.0.6

pingidentitypingfederateRange11.1.0–11.1.5

pingidentitypingfederateRange11.2.0–11.2.2

CPENameOperatorVersion
pingidentity:pingfederatepingidentity pingfederatele10.3.11
pingidentity:pingfederatepingidentity pingfederatele11.0.6
pingidentity:pingfederatepingidentity pingfederatele11.1.5
pingidentity:pingfederatepingidentity pingfederatele11.2.2

CPE	Name	Operator	Version
pingidentity:pingfederate	pingidentity pingfederate	le	10.3.11
pingidentity:pingfederate	pingidentity pingfederate	le	11.0.6
pingidentity:pingfederate	pingidentity pingfederate	le	11.1.5
pingidentity:pingfederate	pingidentity pingfederate	le	11.2.2

CNA Affected

[
  {
    "vendor": "Ping Identity",
    "product": "PingFederate",
    "versions": [
      {
        "version": "10.3.0",
        "status": "affected",
        "lessThan": "10.3.0*",
        "versionType": "custom"
      },
      {
        "version": "10.3.11",
        "status": "affected",
        "lessThanOrEqual": "10.3.11",
        "versionType": "custom"
      },
      {
        "version": "11.0.0",
        "status": "affected",
        "lessThan": "11.0.0*",
        "versionType": "custom"
      },
      {
        "version": "11.0.6",
        "status": "affected",
        "lessThanOrEqual": "11.0.6",
        "versionType": "custom"
      },
      {
        "version": "11.1.0",
        "status": "affected",
        "lessThan": "11.1.0*",
        "versionType": "custom"
      },
      {
        "version": "11.1.5",
        "status": "affected",
        "lessThanOrEqual": "11.1.5",
        "versionType": "custom"
      },
      {
        "version": "11.2.0",
        "status": "affected",
        "lessThan": "11.2.0*",
        "versionType": "custom"
      },
      {
        "version": "11.2.2",
        "status": "affected",
        "lessThanOrEqual": "11.2.2",
        "versionType": "custom"
      }
    ]
  }
]

References

docs.pingidentity.com/r/en-us/pingfederate-110/fll1675188537050

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.7%

JSON

Related for CVE-2022-40724

nvd1 prion1 cvelist1