PT-2023-26844 · Unknown · Pingfederate

Published 2023-10-24 · Updated 2023-10-31 · CVE-2023-39231

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PingFederate (affected versions not specified)

Description The issue allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this to register their own MFA device if they have knowledge of a victim user's first factor credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-306

CWE-288

Related Identifiers

CVE-2023-39231

Affected Products

Pingfederate

References · 7

• https://osv.dev/vulnerability/CVE-2023-39231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39231 · Security Note
• https://twitter.com/CVEnew/status/1716911573694869797 · Twitter Post
• https://pingidentity.com/en/resources/downloads/pingid.html · Note
• https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394 · Note
• https://twitter.com/cracbot/status/1717535489710817678 · Twitter Post
• https://t.me/cvenotify/60241 · Telegram Post