Skip to content
CVE PROGRAM SOURCE RECORD5.8 Medium

CVE-2024-23983

Access rules for PingAccess may be circumvented with URL-encoded characters

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Ping Identity

Description

Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Ping Identity PingAccess

Default version status: unaffected

  • 8.1.0 to < 8.1.1affected
  • 8.0.0 to < 8.0.4affected
  • 7.3.0 to < 7.3.5affected
  • 7.2.0 to < 7.2.4affected
  • 7.1.0 to < 7.1.5affected
  • 7.0.0 to < 7.0.8affected
  • 6.0.0 to < 6.3.9affected

References