Ping Identity PingFederate up to 12.0.0 REST API code injection

Summaryinfo

A vulnerability has been found in Ping Identity PingFederate up to 11.0.9/11.1.9/11.2.8/11.3.4/12.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component REST API. Performing a manipulation results in code injection. This vulnerability is cataloged as CVE-2024-21832. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Ping Identity PingFederate up to 11.0.9/11.1.9/11.2.8/11.3.4/12.0.0. This affects an unknown part of the component REST API. The manipulation with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on integrity. The summary by CVE is:

A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.

The advisory is shared at docs.pingidentity.com. This vulnerability is uniquely identified as CVE-2024-21832 since 01/17/2024. The exploitability is told to be difficult. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Ping Identity

Name

• PingFederate

Version

• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4
• 11.0.5
• 11.0.6
• 11.0.7
• 11.0.8
• 11.0.9
• 11.1.0
• 11.1.1
• 11.1.2
• 11.1.3
• 11.1.4
• 11.1.5
• 11.1.6
• 11.1.7
• 11.1.8
• 11.1.9
• 11.2.0
• 11.2.1
• 11.2.2
• 11.2.3
• 11.2.4
• 11.2.5
• 11.2.6
• 11.2.7
• 11.2.8
• 11.3.0
• 11.3.1
• 11.3.2
• 11.3.3
• 11.3.4
• 12.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion