CVE-2022-40724

Published: Apr 25, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.

Affected (4)

Products: Pingidentity: Pingfederate

Pingidentity

1 product

Pingfederate

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Pingidentity Pingfederate	From 10.3.0 to 10.3.11
Pingidentity Pingfederate	From 11.0.0 to 11.0.6
Pingidentity Pingfederate	From 11.1.0 to 11.1.5
Pingidentity Pingfederate	From 11.2.0 to 11.2.2

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

https://docs.pingidentity.com/r/en-us/pingfederate-110/fll1675188537050

Source: responsible-disclosure@pingidentity.com

Release Notes

https://docs.pingidentity.com/r/en-us/pingfederate-110/fll1675188537050

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

Timeline

No history available yet.