CVE-2024-23316 HIGH

CVE-2024-23316: PingAccess HTTP Request Desynchronization Weakness

Vendor Ping Identity
Product PingAccess
Weakness CWE-444
Published May 31, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/S:P/AU:Y/R:A/RE:M/U:Amber

What the vulnerability does

01Description

HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header requests to create a request smuggling condition for proxied requests.

Key dates

02Disclosure timeline

May 31, 2024 CVE published
August 1, 2024 Record updated