CVE-2024-21832
PingFederate REST API Data Store Injection
A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
PingFederate REST API Data Store Injection
A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.
- Record
CVE-2024-21832- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2024-19444
A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.
- Record
EUVD-2024-19444- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5wh4-q3jw-59rg
A potential JSON injection attack vector exists in PingFederate REST API data stores using the...
A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.
- Record
GHSA-5wh4-q3jw-59rg- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.
- Record
CVE-2024-21832- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-21832 is a low vulnerability (CVSS 3.5) in Ping Identity Pingfederate, published July 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. No source names a fixed version.