PatchTheCVEpingidentity vulnerabilities
Recent CVEs affecting pingidentity products. 9 tracked.
pingidentity has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 7. Most recent: 2024-07-09. Highest priority: CVE-2023-40545 (score 46/100).
- CVE-2024-22477 LOW 1.8 UPGRADE A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor
- CVE-2024-22377 MEDIUM 5.3 UPGRADE The deploy directory in PingFederate runtime nodes is reachable to unauthorized users.
- CVE-2023-40545 HIGH 8.8 DOWNGRADE Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affecte
- CVE-2023-39930 HIGH 7.5 UPGRADE A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MS
- CVE-2023-39231 HIGH 7.3 DOWNGRADE PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second facto
- CVE-2023-39219 HIGH 7.5 UPGRADE PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with cra
- CVE-2023-37283 HIGH 8.1 UPGRADE Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFed
- CVE-2023-36496 HIGH 7.7 UPGRADE Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to ele
- CVE-2023-34085 LOW 2.6 UPGRADE When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of an
FAQ
How do I fix pingidentity vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pingidentity being exploited right now?
None of the tracked pingidentity CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pingidentity CVE should I patch first?
CVE-2023-40545 currently ranks highest (46/100): Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affecte.