CVE-2021-42000: Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows
First published: Thu Feb 10 2022(Updated: )
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.
Credit: responsible-disclosure@pingidentity.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pingidentity Pingfederate | <=9.3.0 | |
| Pingidentity Pingfederate | >=10.0.0<=10.0.11 | |
| Pingidentity Pingfederate | >=10.1.0<=10.1.8 | |
| Pingidentity Pingfederate | >=10.2.0<=10.2.6 | |
| Pingidentity Pingfederate | >=10.3.0<=10.3.2 | |
| Pingidentity Pingfederate | =9.3.3 | |
| Pingidentity Pingfederate | =9.3.3-p15 |
Remedy
PingFederate product patched versions 9.3.3-P16, 10.0.12, 10.1.9, 10.2.7, 10.3.3
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-42000?
CVE-2021-42000 is a vulnerability that allows an existing user to reset another existing user's password in Pingidentity Pingfederate versions up to 10.3.2.
How severe is CVE-2021-42000?
CVE-2021-42000 has a severity score of 6.5 out of 10.
Which software versions are affected by CVE-2021-42000?
CVE-2021-42000 affects Pingidentity Pingfederate versions up to 10.3.2.
How can I fix CVE-2021-42000?
To fix CVE-2021-42000, it is recommended to upgrade to the latest version of Pingidentity Pingfederate.
Where can I find more information about CVE-2021-42000?
You can find more information about CVE-2021-42000 in the Pingidentity Pingfederate documentation and downloads page.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/remedy
- agent/first-publish-date
- agent/event
- agent/author
- agent/description
- agent/tags
- vendor/pingidentity
- canonical/pingidentity pingfederate
- version/pingidentity pingfederate/9.3.0
- version/pingidentity pingfederate/10.0.0
- version/pingidentity pingfederate/10.0.11
- version/pingidentity pingfederate/10.1.0
- version/pingidentity pingfederate/10.1.8
- version/pingidentity pingfederate/10.2.0
- version/pingidentity pingfederate/10.2.6
- version/pingidentity pingfederate/10.3.0
- version/pingidentity pingfederate/10.3.2
- version/pingidentity pingfederate/9.3.3
- version/pingidentity pingfederate/9.3.3-p15