Riskcovery

CVE-2024-21832

PingFederate REST API Data Store Injection

State
Published
Severity
3.5 Low
Published
Jul 9, 2024
Updated
Aug 1, 2024
Reserved
Jan 17, 2024

Read the record on cve.org

Description

A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.

Scores

CVSSScoreVectorSource
3.13.5 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:NPing Identity

Weaknesses

  • CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

ProductVersions
PingFederatePing Identity
  • 11.0.0 through 11.0.9Affected
  • 11.1.0 through 11.1.9Affected
  • 11.2.0 through 11.2.8Affected
  • 11.3.0 through 11.3.4Affected
  • 12.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.