Vulnerability in Ping Identity Pingaccess

CVE-2024-23316

HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header requests to create a request smuggling condition for proxied requests.

Vulnerability class: HTTP Request Smuggling

EPSS: 0.005 (42.6th percentile) — read the EPSS interpretation.

Affected products

Ping Identity Pingaccess — versions 0

Weakness classification (CWE)

CWE-444 — Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling)

References