CVE-2023-34085

Published: Oct 25, 2023Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request

Affected (1)

Products: Pingidentity: Pingfederate

Pingidentity

1 product

Pingfederate

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pingidentity Pingfederate	Up to 11.3.0

Related CWEs

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

References (4)

https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk1689105783244

Source: responsible-disclosure@pingidentity.com

Release Notes

https://www.pingidentity.com/en/resources/downloads/pingfederate.html

Source: responsible-disclosure@pingidentity.com

Release Notes

https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk1689105783244

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://www.pingidentity.com/en/resources/downloads/pingfederate.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

Timeline

No history available yet.