CVE-2023-40545

概要

参考情報

• docs.pingidentity.com/r/en-us/pingfederate-113/hro1701116403236 · Release Notes
• support.pingidentity.com/s/article/SECADV040-PingFederate-OAuth-Client-Authentication-Bypass · Permissions Required
• pingidentity.com/en/resources/downloads/pingfederate/previous-releases.html · Release Notes

pingfederate のその他の脆弱性

• CVE-2024-22477中 4.3A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console use…
• CVE-2024-22377中 5.3The deploy directory in PingFederate runtime nodes is reachable to unauthorized users.
• CVE-2023-39219高 7.5PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumer…
• CVE-2023-37283緊急 9.8Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter…
• CVE-2023-34085中 4.3When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously…