PT-2014-8556 · Ping Identity · Pingfederate

Jing Wang · Publicado 2014-12-12 · Atualizado 2014-12-16 · CVE-2014-8489

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions PingFederate version 6.10.1

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the TargetResource parameter in the startSSO.ping endpoint.

Recommendations For PingFederate version 6.10.1, consider restricting access to the startSSO.ping endpoint to minimize the risk of exploitation. Avoid using the TargetResource parameter in this endpoint until the issue is resolved.

Correção

Identificadores relacionados

CVE-2014-8489

Produtos afetados

Pingfederate

Referências · 4

• http://seclists.org/fulldisclosure/2014/Dec/35 · Nota
• http://tetraph.com/security/cves/cve-2014-8489-ping-identity-corporation-pingfederate-6-10-1-sp-endpoints-dest-redirect-privilege-escalation-security-vulnerability · Nota
• http://packetstormsecurity.com/files/129454/PingFederate-6.10.1-SP-Endpoints-Open-Redirect.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-8489 · Nota de Segurança