Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-40545

Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.

Published

2024-02-06T18:15:58.470

Last Modified

2024-11-21T08:19:41.303

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

Weaknesses

Type: Secondary
CWE-306
Type: Primary
CWE-306

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	pingidentity	pingfederate	11.3.0	Yes

References

https://docs.pingidentity.com/r/en-us/pingfederate-113/hro1701116403236 Release Notes ([email protected])
https://support.pingidentity.com/s/article/SECADV040-PingFederate-OAuth-Client-Authentication-Bypass Permissions Required ([email protected])
https://www.pingidentity.com/en/resources/downloads/pingfederate/previous-releases.html Release Notes ([email protected])
https://docs.pingidentity.com/r/en-us/pingfederate-113/hro1701116403236 Release Notes (af854a3a-2127-422b-91ae-364da2661108)
https://support.pingidentity.com/s/article/SECADV040-PingFederate-OAuth-Client-Authentication-Bypass Permissions Required (af854a3a-2127-422b-91ae-364da2661108)
https://www.pingidentity.com/en/resources/downloads/pingfederate/previous-releases.html Release Notes (af854a3a-2127-422b-91ae-364da2661108)