CVE-2024-23600

Published: Aug 1, 2024Modified: Jun 17, 2026Deferred

2.7

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.2 / Impact: 1.4

Source: responsible-disclosure@pingidentity.com (Secondary)

Description

Improper Input Validation of query search results for private field data in PingIDM (Query Filter module) allows for a potentially efficient brute forcing approach leading to information disclosure.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://backstage.forgerock.com/docs/idcloud/latest/release-notes/regular-channel-changelog.html#changed_functionality

Source: responsible-disclosure@pingidentity.com

https://backstage.forgerock.com/knowledge/kb/article/a95212747

Source: responsible-disclosure@pingidentity.com

http://seclists.org/fulldisclosure/2024/Oct/18

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.