CVE-2024-23983 - OpenCVE

Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Pingidentity	Pingaccess

No data.

No data.

References

Link	Providers
https://docs.pingidentity.com/pingaccess/latest/release_notes/pa_811_rn.html
https://www.pingidentity.com/en/resources/downloads/pingaccess.html

History

Tue, 12 Nov 2024 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Pingidentity Pingidentity pingaccess
CPEs		cpe:2.3:a:pingidentity:pingaccess::::::::
Vendors & Products		Pingidentity Pingidentity pingaccess
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 11 Nov 2024 23:00:00 +0000

Type	Values Removed	Values Added
Description		Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.
Title		Access rules for PingAccess may be circumvented with URL-encoded characters
Weaknesses		CWE-177 CWE-20
References		https://docs.pingidentity.com/pingaccess/latest/release_notes/pa_811_rn.html https://www.pingidentity.com/en/resources/downloads/pingaccess.html
Metrics		cvssV4_0 `{'score': 5.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/S:P/AU:Y/RE:M/U:Amber'}`

MITRE

Status: PUBLISHED

Assigner: Ping Identity

Published: 2024-11-11T22:56:58.036Z

Updated: 2024-11-12T18:51:50.901Z

Reserved: 2024-02-29T23:52:30.472Z

Link: CVE-2024-23983

Vulnrichment

Updated: 2024-11-12T18:51:31.345Z

NVD

Status : Awaiting Analysis

Published: 2024-11-11T23:15:05.217

Modified: 2024-11-12T13:55:21.227

Link: CVE-2024-23983

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23983", "assignerOrgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e", "state": "PUBLISHED", "assignerShortName": "Ping Identity", "dateReserved": "2024-02-29T23:52:30.472Z", "datePublished": "2024-11-11T22:56:58.036Z", "dateUpdated": "2024-11-12T18:51:50.901Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Rules engine"], "product": "PingAccess", "vendor": "Ping Identity", "versions": [{"lessThan": "8.1.1", "status": "affected", "version": "8.1.0", "versionType": "custom"}, {"lessThan": "8.0.4", "status": "affected", "version": "8.0.0", "versionType": "custom"}, {"lessThan": "7.3.5", "status": "affected", "version": "7.3.0", "versionType": "custom"}, {"lessThan": "7.2.4", "status": "affected", "version": "7.2.0", "versionType": "custom"}, {"lessThan": "7.1.5", "status": "affected", "version": "7.1.0", "versionType": "custom"}, {"lessThan": "7.0.8", "status": "affected", "version": "7.0.0", "versionType": "custom"}, {"lessThan": "6.3.9", "status": "affected", "version": "6.0.0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.<br>"}], "value": "Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "PRESENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 5.8, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/S:P/AU:Y/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-177", "description": "CWE-177 Improper Handling of URL Encoding", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e", "shortName": "Ping Identity", "dateUpdated": "2024-11-11T22:56:58.036Z"}, "references": [{"url": "https://docs.pingidentity.com/pingaccess/latest/release_notes/pa_811_rn.html"}, {"url": "https://www.pingidentity.com/en/resources/downloads/pingaccess.html"}], "source": {"defect": ["PA-15776"], "discovery": "EXTERNAL"}, "title": "Access rules for PingAccess may be circumvented with URL-encoded characters", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "pingidentity", "product": "pingaccess", "cpes": ["cpe:2.3:a:pingidentity:pingaccess:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "8.1.0", "status": "affected", "lessThan": "8.1.1", "versionType": "custom"}, {"version": "8.0.0", "status": "affected", "lessThan": "8.0.4", "versionType": "custom"}, {"version": "7.3.0", "status": "affected", "lessThan": "7.3.5", "versionType": "custom"}, {"version": "7.2.0", "status": "affected", "lessThan": "7.2.4", "versionType": "custom"}, {"version": "7.1.0", "status": "affected", "lessThan": "7.1.5", "versionType": "custom"}, {"version": "7.0.0", "status": "affected", "lessThan": "7.0.8", "versionType": "custom"}, {"version": "6.0.0", "status": "affected", "lessThan": "6.3.9", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-12T18:49:35.472344Z", "id": "CVE-2024-23983", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-12T18:51:50.901Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Access rules for PingAccess may be circumvented with URL-encoded characters", "source": {"defect": ["PA-15776"], "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "PRESENT", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.8, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/S:P/AU:Y/RE:M/U:Amber", "providerUrgency": "AMBER", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ping Identity", "modules": ["Rules engine"], "product": "PingAccess", "versions": [{"status": "affected", "version": "8.1.0", "lessThan": "8.1.1", "versionType": "custom"}, {"status": "affected", "version": "8.0.0", "lessThan": "8.0.4", "versionType": "custom"}, {"status": "affected", "version": "7.3.0", "lessThan": "7.3.5", "versionType": "custom"}, {"status": "affected", "version": "7.2.0", "lessThan": "7.2.4", "versionType": "custom"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.5", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.8", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.3.9", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://docs.pingidentity.com/pingaccess/latest/release_notes/pa_811_rn.html"}, {"url": "https://www.pingidentity.com/en/resources/downloads/pingaccess.html"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.", "supportingMedia": [{"type": "text/html", "value": "Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-177", "description": "CWE-177 Improper Handling of URL Encoding"}]}], "providerMetadata": {"orgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e", "shortName": "Ping Identity", "dateUpdated": "2024-11-11T22:56:58.036Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23983", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-12T18:49:35.472344Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:pingidentity:pingaccess:*:*:*:*:*:*:*:*"], "vendor": "pingidentity", "product": "pingaccess", "versions": [{"status": "affected", "version": "8.1.0", "lessThan": "8.1.1", "versionType": "custom"}, {"status": "affected", "version": "8.0.0", "lessThan": "8.0.4", "versionType": "custom"}, {"status": "affected", "version": "7.3.0", "lessThan": "7.3.5", "versionType": "custom"}, {"status": "affected", "version": "7.2.0", "lessThan": "7.2.4", "versionType": "custom"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.5", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.8", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.3.9", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2024-11-12T18:51:31.345Z"}}]}, "cveMetadata": {"cveId": "CVE-2024-23983", "state": "PUBLISHED", "dateUpdated": "2024-11-11T22:56:58.036Z", "dateReserved": "2024-02-29T23:52:30.472Z", "assignerOrgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e", "datePublished": "2024-11-11T22:56:58.036Z", "assignerShortName": "Ping Identity"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules."}, {"lang": "es", "value": "El manejo inadecuado de la codificaci\u00f3n de URL can\u00f3nica puede provocar que las reglas de solicitud no limiten correctamente la omisi\u00f3n."}], "id": "CVE-2024-23983", "lastModified": "2024-11-12T13:55:21.227", "metrics": {"cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "automatable": "YES", "availabilityRequirements": "NOT_DEFINED", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "recovery": "NOT_DEFINED", "safety": "PRESENT", "subsequentSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "HIGH", "subsequentSystemIntegrity": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:M/U:Amber", "version": "4.0", "vulnerabilityResponseEffort": "MODERATE", "vulnerableSystemAvailability": "NONE", "vulnerableSystemConfidentiality": "NONE", "vulnerableSystemIntegrity": "LOW"}, "source": "responsible-disclosure@pingidentity.com", "type": "Secondary"}]}, "published": "2024-11-11T23:15:05.217", "references": [{"source": "responsible-disclosure@pingidentity.com", "url": "https://docs.pingidentity.com/pingaccess/latest/release_notes/pa_811_rn.html"}, {"source": "responsible-disclosure@pingidentity.com", "url": "https://www.pingidentity.com/en/resources/downloads/pingaccess.html"}], "sourceIdentifier": "responsible-disclosure@pingidentity.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-177"}, {"lang": "en", "value": "CWE-20"}], "source": "responsible-disclosure@pingidentity.com", "type": "Secondary"}]}