CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40545 – PingFederate OAuth client_secret_jwt Authentication Bypass
https://notcve.org/view.php?id=CVE-2023-40545
Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests. Omisión de autenticación cuando un cliente OAuth2 utiliza client_secret_jwt como método de autenticación en las versiones 11.3 afectadas a través de solicitudes especialmente manipuladas. • https://docs.pingidentity.com/r/en-us/pingfederate-113/hro1701116403236 https://support.pingidentity.com/s/article/SECADV040-PingFederate-OAuth-Client-Authentication-Bypass https://www.pingidentity.com/en/resources/downloads/pingfederate/previous-releases.html • CWE-306: Missing Authentication for Critical Function •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2023-36496 – Delegated Admin Virtual Attribute Provider Privilege Escalation
https://notcve.org/view.php?id=CVE-2023-36496
Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server. El complemento del proveedor de atributos virtuales Delegated Admin Privilege, cuando está habilitado, permite a un usuario autenticado elevar sus permisos en Directory Server. • https://docs.pingidentity.com/r/en-us/pingdirectory-93/ynf1693338390284 https://support.pingidentity.com/s/article/SECADV039 https://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html • CWE-269: Improper Privilege Management •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34085 – User Attribute Disclosure via DynamoDB Data Stores
https://notcve.org/view.php?id=CVE-2023-34085
When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request Cuando se utiliza una tabla de AWS DynamoDB para el almacenamiento de atributos de usuario, es posible recuperar los atributos de otro usuario mediante una solicitud manipulada con fines malintencionados. • https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk1689105783244 https://www.pingidentity.com/en/resources/downloads/pingfederate.html • CWE-359: Exposure of Private Personal Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-39219 – Admin Console Denial of Service via Java class enumeration
https://notcve.org/view.php?id=CVE-2023-39219
PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests La dependencia de la consola administrativa de PingFederate contiene una debilidad donde la consola deja de responder con solicitudes de enumeración de carga de clases Java manipuladas • https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk1689105783244 https://www.pingidentity.com/en/resources/downloads/pingfederate.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-37283 – Authentication Bypass via HTML Form & Identifier First Adapter
https://notcve.org/view.php?id=CVE-2023-37283
Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter Bajo una configuración muy específica y altamente no recomendada, la omisión de autenticación es posible en PingFederate Identifier First Adapter • https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk1689105783244 https://www.pingidentity.com/en/resources/downloads/pingfederate.html • CWE-287: Improper Authentication •