PT-2024-19804 · Ping Identity · Pingaccess

Published 2024-05-31 · Updated 2024-06-03 · CVE-2024-23316

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:M/U:Amber

Name of the Vulnerable Software and Affected Versions Ping Identity PingAccess versions prior to 8.0.1

Description The issue allows an attacker to send specially crafted HTTP header requests to create a request smuggling condition for proxied requests. This is achieved through HTTP request desynchronization in Ping Identity PingAccess.

Recommendations For versions prior to 8.0.1, update to version 8.0.1 or later to resolve the issue.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2024-23316

Affected Products

Pingaccess

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-23316 · Security Note
• https://t.me/cvenotify/81771 · Telegram Post
• https://support.pingidentity.com/s/article/SECADV045-PA-HTTP-Smuggling · Note
• https://docs.pingidentity.com/r/en-us/pingaccess-80/pa_801_rn · Note
• https://pingidentity.com/en/resources/downloads/pingaccess.html · Note