PT-2014-8556 · Ping Identity · Pingfederate

Jing Wang · Published 2014-12-12 · Updated 2014-12-16 · CVE-2014-8489

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions PingFederate version 6.10.1

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the TargetResource parameter in the startSSO.ping endpoint.

Recommendations For PingFederate version 6.10.1, consider restricting access to the startSSO.ping endpoint to minimize the risk of exploitation. Avoid using the TargetResource parameter in this endpoint until the issue is resolved.

Fix

Related Identifiers

CVE-2014-8489

Affected Products

Pingfederate

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-8489 · Security Note
• http://seclists.org/fulldisclosure/2014/Dec/35 · Note
• http://tetraph.com/security/cves/cve-2014-8489-ping-identity-corporation-pingfederate-6-10-1-sp-endpoints-dest-redirect-privilege-escalation-security-vulnerability · Note
• http://packetstormsecurity.com/files/129454/PingFederate-6.10.1-SP-Endpoints-Open-Redirect.html · Note