CVE-2024-23316CWE-444

PingAccess HTTP Request Desynchronization Weakness

High · published May 31, 2024

CVSS v4.0
8.8
EPSS
1%
Percentile
45.1
In the wild
Unconfirmed
What it is

HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header requests to create a request smuggling condition for proxied requests.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/S:P/AU:Y/R:A/RE:M/U:Amber
EPSS
0.00547 · 45.1th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2024-05-31T19:08Z
EPSS history
Timeline
  • 31 MAY 19:08Z
    PingAccess HTTP Request Desynchronization Weakness
    cvelistv5