« Volver al listado

CVE-2023-40148

Estado: AplazadaMedia (6.5)—

Server-side request forgery (SSRF) in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forged HTTP POST requests.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Pingidentity — PingfederateAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-40148",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-40148",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-12T15:05:58.396831Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "responsible-disclosure@pingidentity.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "responsible-disclosure@pingidentity.com",
      "affectedData": [
        {
          "vendor": "Ping Identity",
          "product": "PingFederate",
          "versions": [
            {
              "status": "affected",
              "version": "11.3.0",
              "versionType": "custom",
              "lessThanOrEqual": "11.3.2"
            },
            {
              "status": "affected",
              "version": "11.2.0",
              "versionType": "custom",
              "lessThanOrEqual": "11.2.7"
            },
            {
              "status": "affected",
              "version": "11.1.0",
              "versionType": "custom",
              "lessThanOrEqual": "11.1.8"
            },
            {
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "11.0.8"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:pingidentity:pingfederate:11.0.0:*:*:*:*:*:*:*"
          ],
          "vendor": "pingidentity",
          "product": "pingfederate",
          "versions": [
            {
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "11.0.8"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:pingidentity:pingfederate:11.1.0:*:*:*:*:*:*:*"
          ],
          "vendor": "pingidentity",
          "product": "pingfederate",
          "versions": [
            {
              "status": "affected",
              "version": "11.1.0",
              "versionType": "custom",
              "lessThanOrEqual": "11.1.8"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:pingidentity:pingfederate:11.2.0:*:*:*:*:*:*:*"
          ],
          "vendor": "pingidentity",
          "product": "pingfederate",
          "versions": [
            {
              "status": "affected",
              "version": "11.2.0",
              "versionType": "custom",
              "lessThanOrEqual": "11.2.7"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:pingidentity:pingfederate:11.3.0:*:*:*:*:*:*:*"
          ],
          "vendor": "pingidentity",
          "product": "pingfederate",
          "versions": [
            {
              "status": "affected",
              "version": "11.3.0",
              "versionType": "custom",
              "lessThanOrEqual": "11.3.2"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-10T00:15:09.630",
  "references": [
    {
      "url": "https://docs.pingidentity.com/r/en-us/pingfederate-120/tuj1708533127032",
      "source": "responsible-disclosure@pingidentity.com"
    },
    {
      "url": "https://www.pingidentity.com/en/resources/downloads/pingfederate/previous-releases.html",
      "source": "responsible-disclosure@pingidentity.com"
    },
    {
      "url": "https://docs.pingidentity.com/r/en-us/pingfederate-120/tuj1708533127032",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.pingidentity.com/en/resources/downloads/pingfederate/previous-releases.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "responsible-disclosure@pingidentity.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Server-side request forgery (SSRF) in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forged HTTP POST requests.\n"
    },
    {
      "lang": "es",
      "value": "Server-Side Request Forgery (SSRF) en PingFederate permite que las solicitudes http no autenticadas ataquen recursos de la red y consuman recursos del lado del servidor a través de solicitudes HTTP POST falsificadas."
    }
  ],
  "lastModified": "2026-06-17T06:16:25.253",
  "sourceIdentifier": "responsible-disclosure@pingidentity.com"
}