Ping Identity Pingidm vulnerabilities

2 vulnerabilities

Known vulnerabilities in Ping Identity Pingidm, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.9CVE-2025-20628ping identitypingidm
EPSS score
0.24%
An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This means attackers can spoof a client-mode RCS (if one exists) to intercept and/or modify an identity’s security-relevant properties, such as passwords and account recovery information. This issue is exploitable only when an RCS is configured to run in client mode.2.7CVE-2024-23600ping identitypingidm
EPSS score
0.67%
Improper Input Validation of query search results for private field data in PingIDM (Query Filter module) allows for a potentially efficient brute forcing approach leading to information disclosure.