Vulnerabilities > CVE-2021-41770 - XXE vulnerability in Pingidentity Pingfederate

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
pingidentity
CWE-611
NVD
Published: 2021-10-07
Updated: 2023-11-07

Summary

Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure.

Vulnerable Configurations

Part Description Count
Application
Pingidentity
12

Common Weakness Enumeration (CWE)

References