What is the CVSS score of CVE-2024-21832?

CVE-2024-21832 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

PingFederate REST API CVE-2024-21832

LOW

Code Injection (CWE-94)

2024-07-09 responsible-disclosure@pingidentity.com

Code Injection RCE

3.5

CVSS 3.1 · Vendor: pingidentity

Severity by source

Vendor (pingidentity) PRIMARY

3.5 LOW

AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Primary rating from Vendor (pingidentity) · only source for this CVE.

CVSS VectorVendor: pingidentity

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Jul 09, 2024 - 23:15 cve.org

LOW 3.5

DescriptionCVE.org

A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.

AnalysisAI

A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.