What is CVE-2021-42000?

CVE-2021-42000 is a medium-severity vulnerability in Ping Identity Pingfederate, classified under Improper Authorization. CVSS score: 5.3/10. Published 2022-02-10.

How severe is CVE-2021-42000?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Auth bypass in Ping Identity Pingfederate

CVE-2021-42000

When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.

EPSS: 0.005 (40.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N.

Affected products

Ping Identity Pingfederate — versions 9.3.3-P15, 10.0.11, 10.1.8
Pingidentity Pingfederate — versions 9.3.3

Weakness classification (CWE)

CWE-285 — Improper Authorization

References

responsible-disclosure@pingidentity.com (x_refsource_MISC, Vendor Advisory)
responsible-disclosure@pingidentity.com (x_refsource_MISC, Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2021-42000?: CVE-2021-42000 is a medium-severity vulnerability in Ping Identity Pingfederate, classified under Improper Authorization. CVSS score: 5.3/10. Published 2022-02-10.
How severe is CVE-2021-42000?: Medium severity. CVSS v3 base score is 5.3 out of 10.