CVE Vulnerabilities

CVE-2023-36496

Improper Privilege Management

Published: Feb 01, 2024 | Modified: Nov 21, 2024
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software

Name Vendor Start Version End Version
Pingdirectory Pingidentity 8.3.0.0 (including) 8.3.0.8 (including)
Pingdirectory Pingidentity 9.0.0.0 (including) 9.0.0.5 (including)
Pingdirectory Pingidentity 9.1.0.0 (including) 9.1.0.2 (including)
Pingdirectory Pingidentity 9.2.0.0 (including) 9.2.0.0 (including)
Pingdirectory Pingidentity 9.2.0.1 (including) 9.2.0.1 (including)
Pingdirectory Pingidentity 9.3.0.0 (including) 9.3.0.0 (including)
Pingdirectory Pingidentity 9.3.0.1 (including) 9.3.0.1 (including)

Potential Mitigations

References