CVE-2022-40724: Pingidentity Pingfederate

High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days.

The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.

Affected products

• Pingidentity Pingfederate: from 10.3.0, up to and including 10.3.11; from 11.0.0, up to and including 11.0.6; from 11.1.0, up to and including 11.1.5; from 11.2.0, up to and including 11.2.2

Published 2023-04-25. Last modified 2026-06-17.