PatchTheCVEpingfederate vulnerabilities and fixes
Recent CVEs affecting pingfederate, with upgrade or downgrade steps. 6 tracked.
pingfederate has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2024-07-09. Highest priority: CVE-2023-40545 (score 46/100).
- CVE-2024-22477 LOW 1.8 UPGRADE A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor
- CVE-2024-22377 MEDIUM 5.3 UPGRADE The deploy directory in PingFederate runtime nodes is reachable to unauthorized users.
- CVE-2023-40545 HIGH 8.8 DOWNGRADE Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affecte
- CVE-2023-39219 HIGH 7.5 UPGRADE PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with cra
- CVE-2023-37283 HIGH 8.1 UPGRADE Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFed
- CVE-2023-34085 LOW 2.6 UPGRADE When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of an
FAQ
How do I fix pingfederate vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pingfederate being exploited right now?
None of the tracked pingfederate CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pingfederate CVE should I patch first?
CVE-2023-40545 currently ranks highest (46/100): Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affecte.