« Volver al listado

CVE-2024-22477

Estado: ModificadaMedia (4.3)—

A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pingidentity — Pingfederate

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-22477",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22477",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-10T13:29:31.833138Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "responsible-disclosure@pingidentity.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 1.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 0.4
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "responsible-disclosure@pingidentity.com",
      "affectedData": [
        {
          "vendor": "Ping Identity",
          "product": "PingFederate",
          "versions": [
            {
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "11.0.9"
            },
            {
              "status": "affected",
              "version": "11.1.0",
              "versionType": "custom",
              "lessThanOrEqual": "11.1.9"
            },
            {
              "status": "affected",
              "version": "11.2.0",
              "versionType": "custom",
              "lessThanOrEqual": "11.2.8"
            },
            {
              "status": "affected",
              "version": "11.3.0",
              "versionType": "custom",
              "lessThanOrEqual": "11.3.4"
            },
            {
              "status": "affected",
              "version": "12.0.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "10.3.0",
              "versionType": "custom",
              "lessThanOrEqual": "10.3.13"
            }
          ],
          "collectionURL": "https://www.pingidentity.com/en/resources/downloads/pingfederate.html",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-07-09T23:15:10.827",
  "references": [
    {
      "url": "https://docs.pingidentity.com/r/en-us/pingfederate-120/lwu1707324350083",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "responsible-disclosure@pingidentity.com"
    },
    {
      "url": "https://docs.pingidentity.com/r/en-us/pingfederate-120/lwu1707324350083",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "responsible-disclosure@pingidentity.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de Cross Site Scripting en la consola de administración de OIDC Policy Management Editor. El impacto está limitado a los usuarios de la consola de administración únicamente."
    }
  ],
  "lastModified": "2026-06-17T07:11:28.763",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73C9BB16-0B50-40AD-991D-CE55D1B4DE56",
              "versionEndIncluding": "10.3.13",
              "versionStartIncluding": "10.3.0"
            },
            {
              "criteria": "cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A809B38-F404-4DB2-BD2C-68D2D4B98A68",
              "versionEndIncluding": "11.0.9",
              "versionStartIncluding": "11.0.0"
            },
            {
              "criteria": "cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "703CAE2D-061F-4FCC-A640-2649656830E4",
              "versionEndIncluding": "11.1.9",
              "versionStartIncluding": "11.1.0"
            },
            {
              "criteria": "cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E7DA8B9-7439-4ABC-A37A-D9FF13D8884C",
              "versionEndIncluding": "11.2.8",
              "versionStartIncluding": "11.2.0"
            },
            {
              "criteria": "cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4425C90D-DBB8-4090-A8F0-8ECE129D19DD",
              "versionEndIncluding": "11.3.4",
              "versionStartIncluding": "11.3.0"
            },
            {
              "criteria": "cpe:2.3:a:pingidentity:pingfederate:12.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A62E1361-EFC7-4242-88AD-995A113A6CFC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "responsible-disclosure@pingidentity.com"
}