CVE-2021-41770

Description

Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure.

Affected Platforms

Weakness Type

CWE-611

References

• https://docs.pingidentity.com/bundle/pingfederate-103/page/ruz1628492711606.html
• https://www.pingidentity.com/en/resources/downloads/pingfederate.html
• https://docs.pingidentity.com/bundle/pingfederate-103/page/ruz1628492711606.html
• https://www.pingidentity.com/en/resources/downloads/pingfederate.html