CVE-2022-40724

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
Ping IdentityPingFederate>= 10.3.0, < 10.3.0*; >= 10.3.11, <= 10.3.11; >= 11.0.0, < 11.0.0*; >= 11.0.6, <= 11.0.6; >= 11.1.0, < 11.1.0*; >= 11.1.5, <= 11.1.5; >= 11.2.0, < 11.2.0*; >= 11.2.2, <= 11.2.2

References

Timeline

Published
Apr 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-407256.1PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts CVE-2022-407327.5An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of WindCVE-2022-407336.5An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of WindCVE-2022-407346.5UniSharp laravel-filemanager (aka Laravel Filemanager) before 2.6.4 allows download?working_dir=%2F.. directory traversal to read arbitrary CVE-2022-407357.5The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, becaCVE-2022-407366.5An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in AP4_CttsAtom::Create in Core/Ap4CttsAtom.cpp.CVE-2022-407376.5An issue was discovered in Bento4 through 1.6.0-639. A buffer over-read exists in the function AP4_StdcFileByteStream::WritePartial located CVE-2022-407386.5An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_DescriptorListWriter::Action in Core/Ap4DescriCVE-2022-407395.4Ragic report generation page has insufficient filtering for special characters. A remote attacker with general user privilege can inject JavCVE-2022-407407.2Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this CVE-2022-407419.8Mail SQR Expert’s specific function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vCVE-2022-407426.5Mail SQR Expert system has a Local File Inclusion vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execut