by Kastro
Paper/Archive/CVE-2021-40329

CVE-2021-40329

Ping Identity PingFederate — The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 66.9.669 × 2013.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.

Affected

ProductAffectedFixed inSource
PingFederate9.2.3–CNA
PingFederate9.3.3–CNA
PingFederate10.0.9–CNA
PingFederate10.1.6–CNA
PingFederate10.2.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refdocs.pingidentity.com/bundle/pingfederate-103/page/cou1615333347158.html