CVE-2022-40724

Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.

State: Published
Severity: 6.4 Medium
Published: Apr 25, 2023
Updated: Feb 4, 2025
Reserved: Sep 14, 2022

Description

The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.

Scores

CVSS	Score	Vector	Source
3.1	6.4 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:H/RL:U/RC:C	Ping Identity

Weaknesses

CWE-352 Cross-Site Request Forgery

Affected Products

Product	Versions
PingFederatePing Identity	10.3.0 to before 10.3.0Affected 10.3.11 through 10.3.11Affected 11.0.0 to before 11.0.0Affected 11.0.6 through 11.0.6Affected 11.1.0 to before 11.1.0Affected 11.1.5 through 11.1.5Affected 11.2.0 to before 11.2.0Affected 11.2.2 through 11.2.2Affected

References

https://docs.pingidentity.com/r/en-us/pingfederate-110/fll1675188537050

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.