CVE-2021-42000
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2021
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
PingFederate
- Vendor
- Ping Identity
- Product
- PingFederate
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 9.3.3-P15 | affected | custom | 9.3.0* | Unavailable | None listed |
| 10.0.11 | affected | custom | 10.0.0* | Unavailable | None listed |
| 10.1.8 | affected | custom | 10.1.0* | Unavailable | None listed |
| 10.2.6 | affected | custom | 10.2.0* | Unavailable | None listed |
| 10.3.2 | affected | custom | 10.3.0* | Unavailable | None listed |