What’s Vulnerable › Vulnerabilities

CVE-2024-23983: Access rules for PingAccess may be circumvented with URL-encoded characters

• Severity: medium (CVSS 5.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-11 · updated 2026-06-17
• Weakness: CWE-20

Description

Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.

Affected products

• Ping Identity PingAccess: from 8.1.0 before 8.1.1; from 8.0.0 before 8.0.4; from 7.3.0 before 7.3.5; from 7.2.0 before 7.2.4; from 7.1.0 before 7.1.5; from 7.0.0 before 7.0.8 — fixed in 6.3.9, 7.0.8, 7.1.5, 7.2.4, 7.3.5, 8.0.4

How to fix

Upgrade to a fixed version: Ping Identity PingAccess 6.3.9, 7.0.8, 7.1.5, 7.2.4. Check the vendor advisory for mitigations.

References

• https://docs.pingidentity.com/pingaccess/latest/release_notes/pa_811_rn.html
• https://www.pingidentity.com/en/resources/downloads/pingaccess.html

Get alerted when CVE-2024-23983 or the next vulnerability affects your stack