Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    4 vulnerabilities found for PingDirectory by Ping Identity

    CVE-2026-20746 (GCVE-0-2026-20746)

    Vulnerability from nvd – Published: 2026-06-12 02:16 – Updated: 2026-06-12 13:30
    VLAI
    Title
    PingDirectory copying of virtual attributes leads to memory exhaustion
    Summary
    Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.
    Severity
    6.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H/S:P/AU:Y/R:U/RE:M/U:Amber
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-401 - Missing release of memory after effective lifetime
    Assigner
    References
    Impacted products
    Vendor Product Version
    Ping Identity PingDirectory Affected: 9.3.0.0 , ≤ 9.3.0.8 (custom)
    Unknown: 10.1.0.0 , ≤ 10.1.0.5 (custom)
    Affected: 10.2.0.0 , ≤ 10.2.0.5 (custom)
    Affected: 10.3.0.0 , ≤ 10.3.0.3 (custom)
    Affected: 11.0.0.0 , < 11.0.0.1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20746",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-12T13:30:44.116370Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T13:30:51.709Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PingDirectory",
          "vendor": "Ping Identity",
          "versions": [
            {
              "lessThanOrEqual": "9.3.0.8",
              "status": "affected",
              "version": "9.3.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "10.1.0.5",
              "status": "unknown",
              "version": "10.1.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "10.2.0.5",
              "status": "affected",
              "version": "10.2.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "10.3.0.3",
              "status": "affected",
              "version": "10.3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "11.0.0.1",
              "status": "affected",
              "version": "11.0.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when\u0026nbsp;recent login history is enabled and copying virtual attributes that reference ds-privilege-name values."
            }
          ],
          "value": "Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when\u00a0recent login history is enabled and copying virtual attributes that reference ds-privilege-name values."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-131",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-131 Resource Leak Exposure"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "USER",
            "Safety": "PRESENT",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H/S:P/AU:Y/R:U/RE:M/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401 Missing release of memory after effective lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-12T02:16:59.690Z",
        "orgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e",
        "shortName": "Ping Identity"
      },
      "references": [
        {
          "url": "https://docs.pingidentity.com/pingdirectory/11.0/release_notes/pd_release_notes.html#pingdirectory-suite-of-products-11-0-0-1-march-2026"
        },
        {
          "url": "https://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html"
        },
        {
          "url": "https://support.pingidentity.com/s/article/SECADV052-Denial-of-Service-via-copying-virtual-attributes"
        }
      ],
      "source": {
        "advisory": "SECADV052",
        "defect": [
          "DS-51122"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "PingDirectory copying of virtual attributes leads to memory exhaustion",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e",
    "assignerShortName": "Ping Identity",
    "cveId": "CVE-2026-20746",
    "datePublished": "2026-06-12T02:16:59.690Z",
    "dateReserved": "2026-01-07T15:15:23.456Z",
    "dateUpdated": "2026-06-12T13:30:51.709Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-36496 (GCVE-0-2023-36496)

    Vulnerability from nvd – Published: 2024-02-01 23:00 – Updated: 2025-06-17 21:29
    VLAI
    Title
    Delegated Admin Virtual Attribute Provider Privilege Escalation
    Summary
    Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.
    Severity
    7.7 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-269 - Improper Privilege Management
    Assigner
    References
    Impacted products
    Vendor Product Version
    Ping Identity PingDirectory Affected: 8.3 , ≤ 8.3.0.8 (8.3.0.9)
    Affected: 9.0 , ≤ 9.0.0.5 (9.0.0.6)
    Affected: 9.1 , ≤ 9.1.0.2 (9.1.0.3)
    Affected: 9.2 , ≤ 9.2.0.1 (9.2.0.2)
    Affected: 9.3 , < 9.3.0.1 (9.3.0.1)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:45:57.106Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.pingidentity.com/s/article/SECADV039"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://docs.pingidentity.com/r/en-us/pingdirectory-93/ynf1693338390284"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36496",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-02T18:01:23.224460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T21:29:22.156Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PingDirectory",
          "vendor": "Ping Identity",
          "versions": [
            {
              "lessThanOrEqual": "8.3.0.8",
              "status": "affected",
              "version": "8.3",
              "versionType": "8.3.0.9"
            },
            {
              "lessThanOrEqual": "9.0.0.5",
              "status": "affected",
              "version": "9.0",
              "versionType": "9.0.0.6"
            },
            {
              "lessThanOrEqual": "9.1.0.2",
              "status": "affected",
              "version": "9.1",
              "versionType": "9.1.0.3"
            },
            {
              "lessThanOrEqual": "9.2.0.1",
              "status": "affected",
              "version": "9.2",
              "versionType": "9.2.0.2"
            },
            {
              "lessThan": "9.3.0.1",
              "status": "affected",
              "version": "9.3",
              "versionType": "9.3.0.1"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Enable Delegated Admin virtual attribute provider"
            }
          ],
          "value": "Enable Delegated Admin virtual attribute provider"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDelegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-01T23:00:03.660Z",
        "orgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e",
        "shortName": "Ping Identity"
      },
      "references": [
        {
          "url": "https://support.pingidentity.com/s/article/SECADV039"
        },
        {
          "url": "https://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html"
        },
        {
          "url": "https://docs.pingidentity.com/r/en-us/pingdirectory-93/ynf1693338390284"
        }
      ],
      "source": {
        "advisory": "SECADV039",
        "defect": [
          "DS-47632"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Delegated Admin Virtual Attribute Provider Privilege Escalation",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e",
    "assignerShortName": "Ping Identity",
    "cveId": "CVE-2023-36496",
    "datePublished": "2024-02-01T23:00:03.660Z",
    "dateReserved": "2023-07-25T20:13:14.880Z",
    "dateUpdated": "2025-06-17T21:29:22.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2026-20746 (GCVE-0-2026-20746)

    Vulnerability from cvelistv5 – Published: 2026-06-12 02:16 – Updated: 2026-06-12 13:30
    VLAI
    Title
    PingDirectory copying of virtual attributes leads to memory exhaustion
    Summary
    Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.
    Severity
    6.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H/S:P/AU:Y/R:U/RE:M/U:Amber
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-401 - Missing release of memory after effective lifetime
    Assigner
    References
    Impacted products
    Vendor Product Version
    Ping Identity PingDirectory Affected: 9.3.0.0 , ≤ 9.3.0.8 (custom)
    Unknown: 10.1.0.0 , ≤ 10.1.0.5 (custom)
    Affected: 10.2.0.0 , ≤ 10.2.0.5 (custom)
    Affected: 10.3.0.0 , ≤ 10.3.0.3 (custom)
    Affected: 11.0.0.0 , < 11.0.0.1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20746",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-12T13:30:44.116370Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T13:30:51.709Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PingDirectory",
          "vendor": "Ping Identity",
          "versions": [
            {
              "lessThanOrEqual": "9.3.0.8",
              "status": "affected",
              "version": "9.3.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "10.1.0.5",
              "status": "unknown",
              "version": "10.1.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "10.2.0.5",
              "status": "affected",
              "version": "10.2.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "10.3.0.3",
              "status": "affected",
              "version": "10.3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "11.0.0.1",
              "status": "affected",
              "version": "11.0.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when\u0026nbsp;recent login history is enabled and copying virtual attributes that reference ds-privilege-name values."
            }
          ],
          "value": "Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when\u00a0recent login history is enabled and copying virtual attributes that reference ds-privilege-name values."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-131",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-131 Resource Leak Exposure"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "USER",
            "Safety": "PRESENT",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H/S:P/AU:Y/R:U/RE:M/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401 Missing release of memory after effective lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-12T02:16:59.690Z",
        "orgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e",
        "shortName": "Ping Identity"
      },
      "references": [
        {
          "url": "https://docs.pingidentity.com/pingdirectory/11.0/release_notes/pd_release_notes.html#pingdirectory-suite-of-products-11-0-0-1-march-2026"
        },
        {
          "url": "https://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html"
        },
        {
          "url": "https://support.pingidentity.com/s/article/SECADV052-Denial-of-Service-via-copying-virtual-attributes"
        }
      ],
      "source": {
        "advisory": "SECADV052",
        "defect": [
          "DS-51122"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "PingDirectory copying of virtual attributes leads to memory exhaustion",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e",
    "assignerShortName": "Ping Identity",
    "cveId": "CVE-2026-20746",
    "datePublished": "2026-06-12T02:16:59.690Z",
    "dateReserved": "2026-01-07T15:15:23.456Z",
    "dateUpdated": "2026-06-12T13:30:51.709Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-36496 (GCVE-0-2023-36496)

    Vulnerability from cvelistv5 – Published: 2024-02-01 23:00 – Updated: 2025-06-17 21:29
    VLAI
    Title
    Delegated Admin Virtual Attribute Provider Privilege Escalation
    Summary
    Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.
    Severity
    7.7 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-269 - Improper Privilege Management
    Assigner
    References
    Impacted products
    Vendor Product Version
    Ping Identity PingDirectory Affected: 8.3 , ≤ 8.3.0.8 (8.3.0.9)
    Affected: 9.0 , ≤ 9.0.0.5 (9.0.0.6)
    Affected: 9.1 , ≤ 9.1.0.2 (9.1.0.3)
    Affected: 9.2 , ≤ 9.2.0.1 (9.2.0.2)
    Affected: 9.3 , < 9.3.0.1 (9.3.0.1)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:45:57.106Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.pingidentity.com/s/article/SECADV039"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://docs.pingidentity.com/r/en-us/pingdirectory-93/ynf1693338390284"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36496",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-02T18:01:23.224460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T21:29:22.156Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PingDirectory",
          "vendor": "Ping Identity",
          "versions": [
            {
              "lessThanOrEqual": "8.3.0.8",
              "status": "affected",
              "version": "8.3",
              "versionType": "8.3.0.9"
            },
            {
              "lessThanOrEqual": "9.0.0.5",
              "status": "affected",
              "version": "9.0",
              "versionType": "9.0.0.6"
            },
            {
              "lessThanOrEqual": "9.1.0.2",
              "status": "affected",
              "version": "9.1",
              "versionType": "9.1.0.3"
            },
            {
              "lessThanOrEqual": "9.2.0.1",
              "status": "affected",
              "version": "9.2",
              "versionType": "9.2.0.2"
            },
            {
              "lessThan": "9.3.0.1",
              "status": "affected",
              "version": "9.3",
              "versionType": "9.3.0.1"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Enable Delegated Admin virtual attribute provider"
            }
          ],
          "value": "Enable Delegated Admin virtual attribute provider"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDelegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-01T23:00:03.660Z",
        "orgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e",
        "shortName": "Ping Identity"
      },
      "references": [
        {
          "url": "https://support.pingidentity.com/s/article/SECADV039"
        },
        {
          "url": "https://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html"
        },
        {
          "url": "https://docs.pingidentity.com/r/en-us/pingdirectory-93/ynf1693338390284"
        }
      ],
      "source": {
        "advisory": "SECADV039",
        "defect": [
          "DS-47632"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Delegated Admin Virtual Attribute Provider Privilege Escalation",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e",
    "assignerShortName": "Ping Identity",
    "cveId": "CVE-2023-36496",
    "datePublished": "2024-02-01T23:00:03.660Z",
    "dateReserved": "2023-07-25T20:13:14.880Z",
    "dateUpdated": "2025-06-17T21:29:22.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}