Admin Console Denial of Service via Java class enumeration
CVE-2023-39219

7.5HIGH

Key Information:

Vendor

Ping Identity

Status
Pingfederate
Vendor
CVE Published:
25 October 2023

What is CVE-2023-39219?

The PingFederate Administrative Console is susceptible to a vulnerability that can render the console unresponsive when faced with specifically crafted Java class loading enumeration requests. This issue arises from improper handling of these requests, allowing attackers to disrupt the functionality of the administrative interface. Organizations utilizing PingFederate should evaluate their environments for this weakness and consider implementing necessary precautions.

Affected Version(s)

PingFederate 11.3 <= 11.3.0

PingFederate 11.2.0 <= 11.2.6

PingFederate 11.1.0 <= 11.1.7

References

https://www.pingidentity.com/en/resources/downloads/pingf...
https://docs.pingidentity.com/r/en-us/pingfederate-113/gy...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-39219 : Admin Console Denial of Service via Java class enumeration