PT-2023-27162 · Ping Identity · Pingfederate

Published 2023-10-24 · Updated 2023-10-31 · CVE-2023-39930

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PingFederate with PingID Radius PCV (affected versions not specified)

Description A first-factor authentication bypass issue exists when a MSCHAP authentication request is sent via a maliciously crafted RADIUS client request. This allows for potential bypass of first-factor authentication in the PingFederate with PingID Radius PCV.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-306

CWE-288

Related Identifiers

CVE-2023-39930

Affected Products

Pingfederate

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-39930 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39930 · Vendor Advisory
• https://pingidentity.com/en/resources/downloads/pingfederate.html · Note
• https://twitter.com/cracbot/status/1717535492361580640 · Twitter Post
• https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_26_rn · Note
• https://twitter.com/CVEnew/status/1716925968055419018 · Twitter Post