Delegated Admin Privilege Vulnerability in Ping Identity Directory Server

CVE-2023-36496

What is CVE-2023-36496?

The vulnerability affects the Delegated Admin Privilege virtual attribute provider plugin in Ping Identity's Directory Server, which when enabled, permits an authenticated user to escalate their permissions. This unauthorized elevation of privileges could potentially allow a user to gain excessive control over sensitive management functions within the Directory Server, leading to potential security breaches. Organizations using affected versions of the Directory Server should review their configurations and apply necessary patches to mitigate the associated risks.

References