CVE-2021-31923: 
PingAccess vulnerability analysis and mitigation

Ping Identity PingAccess before version 5.3.3 was discovered to contain a vulnerability that allows HTTP request smuggling via header manipulation. The vulnerability was assigned identifier CVE-2021-31923 and was disclosed in September 2021 (NVD).

The vulnerability is classified as a CWE-444 (Inconsistent Interpretation of HTTP Requests) issue. It received a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating it is network accessible, requires low attack complexity, needs no privileges or user interaction, and can impact integrity (NVD).

The vulnerability allows attackers to perform HTTP request smuggling attacks through manipulation of headers. This could potentially lead to request queue poisoning, cache poisoning, or request bypass (NVD).

The vulnerability requires no special privileges or user interaction to exploit, making it relatively straightforward for attackers to leverage. The attack can be performed remotely over the network (NVD).

The recommended mitigation is to upgrade PingAccess to version 5.3.3 or later which contains fixes for this vulnerability (Ping Docs).