What’s Vulnerable › Vulnerabilities

CVE-2023-40148: PingFederate Server Side Request Forgery vulnerability

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-10 · updated 2026-06-17
• Weakness: CWE-918

Description

Server-side request forgery (SSRF) in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forged HTTP POST requests.

Affected products

• Ping Identity PingFederate: from 11.0.0 through 11.0.8; from 11.1.0 through 11.1.8; from 11.2.0 through 11.2.7; from 11.3.0 through 11.3.2

References

• https://docs.pingidentity.com/r/en-us/pingfederate-120/tuj1708533127032
• https://www.pingidentity.com/en/resources/downloads/pingfederate/previous-releases.html
• https://docs.pingidentity.com/r/en-us/pingfederate-120/tuj1708533127032
• https://www.pingidentity.com/en/resources/downloads/pingfederate/previous-releases.html

Get alerted when CVE-2023-40148 or the next vulnerability affects your stack