PT-2022-16230 · Unknown · Spring Boot+1

Published 2022-09-30 · Updated 2022-10-04 · CVE-2022-23726

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PingCentral versions prior to listed versions

Description The issue exposes Spring Boot actuator endpoints, which can return large amounts of sensitive environmental and application information when accessed with administrative authentication.

Recommendations For versions prior to the listed versions, consider restricting access to the Spring Boot actuator endpoints as a temporary workaround until a patch is available. Additionally, review and limit administrative authentication to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Incorrect Permission

Weakness Enumeration

CWE-200

CWE-732

Related Identifiers

CVE-2022-23726

Affected Products

Pingcentral

Spring Boot

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-23726 · Security Note
• https://docs.pingidentity.com/bundle/pingcentral-110/page/sdd1651696160285.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23726 · Vendor Advisory
• https://pingidentity.com/en/resources/downloads/pingcentral.html · Note
• https://t.me/cibsecurity/50769 · Telegram Post