Unauthenticated HTTP Requests Can Attack Network Resources via Server-Side Request Forgery (SSRF)
CVE-2023-40148

6.5MEDIUM

Key Information:

Vendor

Ping Identity

Status
Pingfederate
Vendor
CVE Published:
10 April 2024

What is CVE-2023-40148?

A vulnerability exists in PingFederate that permits unauthenticated actors to perform server-side request forgery (SSRF). This flaw enables attackers to forge HTTP POST requests that can interact with internal network resources, potentially leading to unauthorized access and resource consumption on the server. Organizations using affected versions of PingFederate must apply necessary security measures to mitigate exploitation risks associated with this vulnerability.

Affected Version(s)

PingFederate 11.3.0 <= 11.3.2

PingFederate 11.2.0 <= 11.2.7

PingFederate 11.1.0 <= 11.1.8

References

https://docs.pingidentity.com/r/en-us/pingfederate-120/tu...
https://www.pingidentity.com/en/resources/downloads/pingf...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.