title: Delegated Admin Virtual Attribute Provider Privilege Escalation
description: Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.
problem types: CWE-269 Improper Privilege Management
affected:
{
defaultStatus: unaffected
product: PingDirectory
vendor: Ping Identity
versions:
lessThanOrEqual: 8.3.0.8, status: affected, version: 8.3, versionType: 8.3.0.9
lessThanOrEqual: 9.0.0.5, status: affected, version: 9.0, versionType: 9.0.0.6
lessThanOrEqual: 9.1.0.2, status: affected, version: 9.1, versionType: 9.1.0.3
lessThanOrEqual: 9.2.0.1, status: affected, version: 9.2, versionType: 9.2.0.2
lessThan: 9.3.0.1, status: affected, version: 9.3, versionType: 9.3.0.1
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL