Authentication flaw

2022-05-0222:15:00

PRIOn knowledge base

www.prio-n.com

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.0%

JSON

When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing userâ€™s password.

CPENameOperatorVersion
pingfederateeq9.3.3 p15
pingfederatege9.3.0
pingfederatelt9.3.3
pingfederatege10.0.0
pingfederatelt10.0.12
pingfederatege10.1.0
pingfederatelt10.1.9
pingfederatege10.2.0
pingfederatelt10.2.7
pingfederatege10.3.0

Name	Operator	Version
pingfederate	eq	9.3.3 p15
pingfederate	ge	9.3.0
pingfederate	lt	9.3.3
pingfederate	ge	10.0.0
pingfederate	lt	10.0.12
pingfederate	ge	10.1.0
pingfederate	lt	10.1.9
pingfederate	ge	10.2.0
pingfederate	lt	10.2.7
pingfederate	ge	10.3.0