CVE-2024-23316

N/A Unknown

Published: May 31, 2024 Modified: April 15, 2026

Description

HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header requests to create a request smuggling condition for proxied requests.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://docs.pingidentity.com/r/en-us/pingaccess-80/pa_801_rn

Source: responsible-disclosure@pingidentity.com

https://support.pingidentity.com/s/article/SECADV045-PA-HTTP-Smuggling

Source: responsible-disclosure@pingidentity.com

https://www.pingidentity.com/en/resources/downloads/pingaccess.html

Source: responsible-disclosure@pingidentity.com

https://docs.pingidentity.com/r/en-us/pingaccess-80/pa_801_rn

Source: af854a3a-2127-422b-91ae-364da2661108

https://support.pingidentity.com/s/article/SECADV045-PA-HTTP-Smuggling

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.pingidentity.com/en/resources/downloads/pingaccess.html

Source: af854a3a-2127-422b-91ae-364da2661108

6 reference(s) from NVD

Quick Stats

CVSS v3 Score

N/A / 10.0

EPSS (Exploit Probability)

0.8%

74th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-444

Related CVEs