CVE-2024-23316: PingAccess HTTP Request Desynchronization Weakness
Published May 31, 2024
·Updated
HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header requests to create a request smuggling condition for proxied requests.
Affected Software
1 affected component
Ping Identity PingAccess<8.0.1
Event History
May 31, 2024
CVE Published
via MITRE·07:08 PM
Data Sourced
via MITRE·07:08 PM
DescriptionWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-23316?
CVE-2024-23316 is classified as a critical vulnerability due to its potential to allow HTTP request smuggling attacks.
2
How do I fix CVE-2024-23316?
To mitigate CVE-2024-23316, upgrade Ping Identity PingAccess to version 8.0.1 or later.
3
Which versions of Ping Identity PingAccess are affected by CVE-2024-23316?
CVE-2024-23316 affects all versions of Ping Identity PingAccess prior to 8.0.1.
4
What types of attacks can CVE-2024-23316 enable?
CVE-2024-23316 can allow attackers to exploit HTTP request desynchronization, potentially leading to request smuggling.
5
Is CVE-2024-23316 remotely exploitable?
Yes, CVE-2024-23316 can be exploited remotely by sending specially crafted HTTP header requests.