Lucene search

Ping IdentityVULNRICHMENT:CVE-2023-39930

HistoryOct 24, 2023 - 8:54 p.m.

CVE-2023-39930 PingFederate PingID Radius PCV Authentication Bypass

2023-10-2420:54:08

CWE-288

Ping Identity

github.com

pingfederate

pingid

radius

pcv

authentication bypass

cve-2023-39930

mschap

radius client request

vulnerability

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

Low

EPSS

0.001

Percentile

43.8%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a maliciously crafted RADIUS client request.

References

docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_26_rn

www.pingidentity.com/en/resources/downloads/pingfederate.html

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

Low

EPSS

0.001

Percentile

43.8%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2023-39930