When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.
Weakness
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pingfederate | Pingidentity | 9.3.0 (including) | 9.3.3 (excluding) |
| Pingfederate | Pingidentity | 10.0.0 (including) | 10.0.12 (excluding) |
| Pingfederate | Pingidentity | 10.1.0 (including) | 10.1.9 (excluding) |
| Pingfederate | Pingidentity | 10.2.0 (including) | 10.2.7 (excluding) |
| Pingfederate | Pingidentity | 10.3.0 (including) | 10.3.4 (excluding) |
| Pingfederate | Pingidentity | 9.3.3-p15 (including) | 9.3.3-p15 (including) |
| Pingfederate | Pingidentity | 11.0.0 (including) | 11.0.0 (including) |