Pingfederate

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorPingidentity (f56e02bf-5fbe-54aa-9dfd-2b764962bd7c)
ProductPingfederate (a526eb7e-24df-5707-978d-39838877022a)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:docker/pingidentity/pingfederate purl2cpe 2026-06-01 10:12:01.767941

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-22477 vulnerable 2026-06-08 06:29:35.847543 PingFederate OIDC Policy Management Editor Cross-Site Scripting
LOW (1.8)
A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only.
Published: 2024-07-09T23:01:28.611Z
Updated: 2024-08-01T22:51:09.905Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-22377 vulnerable 2026-06-08 06:29:34.754971 PingFederate Runtime Node Path Traversal
MEDIUM (5.3)
The deploy directory in PingFederate runtime nodes is reachable to unauthorized users.
Published: 2024-07-09T23:03:27.722Z
Updated: 2024-08-01T22:43:34.512Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-40545 vulnerable 2026-06-08 06:11:03.576466 PingFederate OAuth client_secret_jwt Authentication Bypass
HIGH (8.8)
Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.
Published: 2024-02-06T17:27:42.361Z
Updated: 2024-08-22T16:53:12.079Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-39219 vulnerable 2026-06-08 06:09:35.999522 Admin Console Denial of Service via Java class enumeration
HIGH (7.5)
PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests
Published: 2023-10-25T01:44:44.362Z
Updated: 2025-06-12T14:58:40.168Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-37283 vulnerable 2026-06-08 06:08:15.074097 Authentication Bypass via HTML Form & Identifier First Adapter
HIGH (8.1)
Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter
Published: 2023-10-25T01:24:47.780Z
Updated: 2024-08-02T17:09:34.014Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-34085 vulnerable 2026-06-08 06:06:24.375543 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-40724 vulnerable 2026-06-08 05:48:28.030625 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-40723 vulnerable 2026-06-08 05:48:28.027652 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-40722 vulnerable 2026-06-08 05:48:28.023336 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-23722 vulnerable 2026-06-08 05:40:58.293116 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-42000 vulnerable 2026-06-08 05:35:21.352331 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-41770 vulnerable 2026-06-08 05:35:21.006394 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-40329 vulnerable 2026-06-08 05:35:17.405537 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.