Skip to content
OpenAdvisories
Medium · 6.4 CVE-2022-40724

Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.

Published Apr 25, 2023 · Updated Feb 4, 2025 · Assigned by Ping Identity

Vendor: Ping Identity Product: PingFederate

Description

The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.

Affected products

VendorProductAffectedFixed
Ping Identity PingFederate 10.3.0 – < 10.3.0*, 10.3.11 – ≤ 10.3.11, 11.0.0 – < 11.0.0*, 11.0.6 – ≤ 11.0.6, 11.1.0 – < 11.1.0*, 11.1.5 – ≤ 11.1.5, 11.2.0 – < 11.2.0*, 11.2.2 – ≤ 11.2.2 10.3.0*

References