CVE-2024-23600

Improper Input Validation of query search results for private field data in PingIDM (Query Filter module) allows for a potentially efficient brute forcing approach leading to information disclosure.

Score

CVSS 3.1 2.7 Low

Status

Deferred - responsible-disclosure@pingidentity.com

Published

2024-08-01

Last modified

2024-10-31

Weaknesses

CWE-20

Affected products

• Pingidm (Ping Identity)

References

• https://backstage.forgerock.com/docs/idcloud/latest/release-notes/regular-channel-changelog.html#changed_functionality
• https://backstage.forgerock.com/knowledge/kb/article/a95212747
• http://seclists.org/fulldisclosure/2024/Oct/18