Lucene search
HistoryJul 09, 2024 - 11:15 p.m.
CVE-2024-22477
cross-site scripting
oidc
policy management
admin console users
CVSS3
4.3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS
0
Percentile
9.2%
A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only.
Affected configurations
Node
pingidentitypingfederateRange10.3.0–10.3.13
ORpingidentitypingfederateRange11.0.0–11.0.9
ORpingidentitypingfederateRange11.1.0–11.1.9
ORpingidentitypingfederateRange11.2.0–11.2.8
ORpingidentitypingfederateRange11.3.0–11.3.4
ORpingidentitypingfederateMatch12.0.0
| Vendor | Product | Version | CPE |
|---|---|---|---|
| pingidentity | pingfederate | * | cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:* |
| pingidentity | pingfederate | 12.0.0 | cpe:2.3:a:pingidentity:pingfederate:12.0.0:*:*:*:*:*:*:* |
CVSS3
4.3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS
0
Percentile
9.2%
Related for NVD:CVE-2024-22477