Lucene search

Ping IdentityCVELIST:CVE-2024-21832

HistoryJul 09, 2024 - 11:04 p.m.

CVE-2024-21832 PingFederate REST API Data Store Injection

2024-07-0923:04:55

CWE-94

Ping Identity

www.cve.org

pingfederate

json injection

data store

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

EPSS

Percentile

9.2%

JSON

A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.

CNA Affected

[
  {
    "collectionURL": "https://www.pingidentity.com/en/resources/downloads/pingfederate.html",
    "defaultStatus": "unaffected",
    "product": "PingFederate",
    "vendor": "Ping Identity",
    "versions": [
      {
        "lessThanOrEqual": "11.0.9",
        "status": "affected",
        "version": "11.0.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "11.1.9",
        "status": "affected",
        "version": "11.1.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "11.2.8",
        "status": "affected",
        "version": "11.2.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "11.3.4",
        "status": "affected",
        "version": "11.3.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "12.0.0",
        "versionType": "custom"
      }
    ]
  }
]

References

docs.pingidentity.com/r/en-us/pingfederate-120/lwu1707324350083

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

EPSS

Percentile

9.2%

JSON

Related for CVELIST:CVE-2024-21832