PT-2023-26844 · Unknown · Pingfederate
CVE-2023-39231
·
Publicado
2023-10-24
·
Atualizado
2023-10-31
CVSS v3.1
7.3
Alta
| Vetor | AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
PingFederate (affected versions not specified)
Description
The issue allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this to register their own MFA device if they have knowledge of a victim user's first factor credentials.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Missing Authentication
Authentication Bypass Using an Alternate Path or Channel
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Pingfederate