CVE-2024-23316

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header requests to create a request smuggling condition for proxied requests.

Metrics

CVSS 4.0 8.8/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:M/U:Amber

Weakness enumeration

CWE-444

Affected software

Vendor	Product	Versions
Ping Identity	PingAccess	< 8.0.1
pingidentity	pingaccess	< 8.0.1

References

Timeline

Published: May 31, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-233176.3External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Contro CVE-2024-233193.5Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a CVE-2024-23327.2A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. This issue affects some unkno CVE-2024-233208.8Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be CVE-2024-233218.8For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized act CVE-2024-233227.5Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occ CVE-2024-233235.3Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage a CVE-2024-233247.5Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients CVE-2024-233257.5Envoy is a high-performance edge/middle/service proxy. Envoy crashes in Proxy protocol when using an address type that isn’t supported by th CVE-2024-233268.2Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server CVE-2024-233277.5Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance wi CVE-2024-233289.1Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be