Skip to content
OpenAdvisories
High · 7.7 CVE-2023-36496 EUVD-2023-40445GHSA-x5c7-28cx-8rh5

Delegated Admin Virtual Attribute Provider Privilege Escalation

Published Feb 1, 2024 · Updated Jun 17, 2025 · Assigned by Ping Identity

Description

Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.

Affected products

VendorProductAffectedFixed
Ping Identity PingDirectory 8.3 – ≤ 8.3.0.8, 9.0 – ≤ 9.0.0.5, 9.1 – ≤ 9.1.0.2, 9.2 – ≤ 9.2.0.1, 9.3 – < 9.3.0.1 9.3.0.1

References