CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-40724 – Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.
https://notcve.org/view.php?id=CVE-2022-40724
The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests. • https://docs.pingidentity.com/r/en-us/pingfederate-110/fll1675188537050 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 0CVE-2022-40722 – Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.
https://notcve.org/view.php?id=CVE-2022-40722
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA. • https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_20_rn • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-780: Use of RSA Algorithm without OAEP •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2022-23722 – PingFederate Password Reset via Authentication API Mishandling
https://notcve.org/view.php?id=CVE-2022-23722
When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password. Cuando un mecanismo de restablecimiento de contraseña está configurado para usar la API de Autenticación con una Política de Autenticación, una Contraseña de Una sola vez por correo electrónico, PingID o autenticación por SMS, un usuario existente puede restablecer la contraseña de otro usuario existente • https://docs.pingidentity.com/bundle/pingfederate-110/page/spk1642790928508.html https://www.pingidentity.com/en/resources/downloads/pingfederate.html • CWE-287: Improper Authentication CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2021-42000 – Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows
https://notcve.org/view.php?id=CVE-2021-42000
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password. Cuando es configurado un flujo de restablecimiento o cambio de contraseña con una política de autenticación y el adaptador de la política de restablecimiento o cambio admite varios flujos de restablecimiento paralelos, un usuario existente puede restablecer la contraseña de otro usuario existente • https://docs.pingidentity.com/bundle/pingfederate-103/page/hhm1634833631515.html https://www.pingidentity.com/en/resources/downloads/pingfederate.html • CWE-285: Improper Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41770
https://notcve.org/view.php?id=CVE-2021-41770
Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure. Ping Identity PingFederate versiones anteriores a 10.3.1, maneja inapropiadamente la comprobación de preanálisis, conllevando a un ataque de tipo XXE que puede lograr una divulgación de archivos XML • https://docs.pingidentity.com/bundle/pingfederate-103/page/ruz1628492711606.html https://www.pingidentity.com/en/resources/downloads/pingfederate.html • CWE-611: Improper Restriction of XML External Entity Reference •