CVE-2024-23983: Access rules for PingAccess may be circumvented with URL-encoded characters

Medium severity · published Nov 11, 2024

CVE-2024-23983

Access rules for PingAccess may be circumvented with URL-encoded characters

5.8

CVSS

0.4%

EPSS

On KEV

Description

Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 37% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

PingAccess · Ping Identity

8.1.0 before 8.1.1; 8.0.0 before 8.0.4; 7.3.0 before 7.3.5; 7.2.0 before 7.2.4; 7.1.0 before 7.1.5; 7.0.0 before 7.0.8; +1 more · source: vendor, CISA

Affected product

PingAccess

Ping Identity

All PingAccess CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-23983

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-23983

docs.pingidentity.com

https://docs.pingidentity.com/pingaccess/latest/release_notes/pa_811_rn.html

www.pingidentity.com

https://www.pingidentity.com/en/resources/downloads/pingaccess.html