Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2024-25573

Stored Cross-Site Scripting in Administrative Console Context

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Ping Identity

Description

Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Ping Identity PingFederate

Default version status: unaffected

  • 12.1.0 to ≤ 12.1.4affected
  • 12.0.0 to ≤ 12.0.6affected
  • 11.3.0 to ≤ 11.3.9affected
  • 11.2.0 to ≤ 11.2.10affected

References