Skip to content
CVE PROGRAM SOURCE RECORD6.4 Medium

CVE-2022-40724

Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Ping Identity

Description

The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Ping Identity PingFederate

  • 10.3.0 to < 10.3.0*affected
  • 10.3.11 to ≤ 10.3.11affected
  • 11.0.0 to < 11.0.0*affected
  • 11.0.6 to ≤ 11.0.6affected
  • 11.1.0 to < 11.1.0*affected
  • 11.1.5 to ≤ 11.1.5affected
  • 11.2.0 to < 11.2.0*affected
  • 11.2.2 to ≤ 11.2.2affected

References