CVEvulnerability

CVE-2021-42000

6.5 MEDIUM Published 2022-02-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-02-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-285

Description

When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.

Affected configurations

• pingidentity pingfederate (<= 9.3.0) • pingidentity pingfederate (>= 10.0.0 <= 10.0.11) • pingidentity pingfederate (>= 10.1.0 <= 10.1.8) • pingidentity pingfederate (>= 10.2.0 <= 10.2.6) • pingidentity pingfederate (>= 10.3.0 <= 10.3.2) • pingidentity pingfederate 9.3.3

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References