CVE-2024-25573

published 2025-06-15

CVE-2024-25573: Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing.

Priority P4 30 medium 6.9 CVSS 4.0

AV N AC H AT P PR H UI A VC L VI H VA N SC L SI H SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S P AU N R U V X RE M U Red

Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
ping_identity	pingfederate	11.2.0 – 11.2.10	—
ping_identity	pingfederate	11.3.0 – 11.3.9	—
ping_identity	pingfederate	12.0.0 – 12.0.6	—
ping_identity	pingfederate	12.1.0 – 12.1.4	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79