CVE-2023-34085

Summary

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request

Affected Software

Weaknesses

• CWE-359: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

ADP Enrichment

CVE Program Container

Additional References

• https://www.pingidentity.com/en/resources/downloads/pingfederate.html
• https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk1689105783244

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://www.pingidentity.com/en/resources/downloads/pingfederate.html
• https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk1689105783244

• ←Previous
• Next→