CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34085 – User Attribute Disclosure via DynamoDB Data Stores
https://notcve.org/view.php?id=CVE-2023-34085
When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request Cuando se utiliza una tabla de AWS DynamoDB para el almacenamiento de atributos de usuario, es posible recuperar los atributos de otro usuario mediante una solicitud manipulada con fines malintencionados. • https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk1689105783244 https://www.pingidentity.com/en/resources/downloads/pingfederate.html • CWE-359: Exposure of Private Personal Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-39219 – Admin Console Denial of Service via Java class enumeration
https://notcve.org/view.php?id=CVE-2023-39219
PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests La dependencia de la consola administrativa de PingFederate contiene una debilidad donde la consola deja de responder con solicitudes de enumeración de carga de clases Java manipuladas • https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk1689105783244 https://www.pingidentity.com/en/resources/downloads/pingfederate.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-37283 – Authentication Bypass via HTML Form & Identifier First Adapter
https://notcve.org/view.php?id=CVE-2023-37283
Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter Bajo una configuración muy específica y altamente no recomendada, la omisión de autenticación es posible en PingFederate Identifier First Adapter • https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk1689105783244 https://www.pingidentity.com/en/resources/downloads/pingfederate.html • CWE-287: Improper Authentication •
CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 0CVE-2022-40722 – Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.
https://notcve.org/view.php?id=CVE-2022-40722
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA. • https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_20_rn • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-780: Use of RSA Algorithm without OAEP •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-40723 – Configuration-based MFA Bypass in PingID RADIUS PCV.
https://notcve.org/view.php?id=CVE-2022-40723
The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations. • https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_19_rn • CWE-287: Improper Authentication CWE-305: Authentication Bypass by Primary Weakness •