CVE-2024-25573 | THREATINT

Description

Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing.

Reserved 2024-02-29 | Published 2025-06-15 | Updated 2025-06-15 | Assigner Ping Identity

MEDIUM: 6.9CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/S:P/AU:N/R:U/RE:M/U:Red

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status

unaffected

12.1.0

affected

12.0.0

affected

11.3.0

affected

11.2.0

affected

References

docs.pingidentity.com/...release_notes/pf_release_notes.html release-notes

www.pingidentity.com/...esources/downloads/pingfederate.html patch

cve.org (CVE-2024-25573)

nvd.nist.gov (CVE-2024-25573)

Download JSON