CVE-2024-22477 PingFederate OIDC Policy Management Editor Cross-Site Scripting
An attacker can execute scripts in the admin console via the OIDC Policy Management Editor, potentially compromising administrator accounts.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-22477?
CVE-2024-22477 is a low-severity cross-site scripting vulnerability in PingFederate, published on 9 Jul 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only.
Weakness: CWE-79
Which versions are affected by CVE-2024-22477?
It affects 1 product.
Products include Pingidentity Pingfederate.
How do I fix CVE-2024-22477?
No fix has been published for CVE-2024-22477 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-22477 being exploited?
There is no known exploitation of CVE-2024-22477 in the wild and no public exploit code.
Other vulnerabilities in PingFederate
- CVE-2021-40329 The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.
- CVE-2023-40545 PingFederate OAuth client_secret_jwt Authentication Bypass
- CVE-2023-37283 Authentication Bypass via HTML Form & Identifier First Adapter
- CVE-2022-40722 Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.
- CVE-2023-39219 Admin Console Denial of Service via Java class enumeration
Sources
Also known as GHSA-8wcf-q4vh-rh5h.