Unscored severity · published Dec 12, 2014
CVE-2014-8489
Open redirect vulnerability in startSSO.ping in the SP Endpoints in Ping Identity PingFederate 6.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct…
–
CVSS
2.9%
EPSS
No
On KEV
Description
Open redirect vulnerability in startSSO.ping in the SP Endpoints in Ping Identity PingFederate 6.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the TargetResource parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
Pingfederate · Pingidentity
6.10.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8489
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8489
packetstormsecurity.com
http://packetstormsecurity.com/files/129454/PingFederate-6.10.1-SP-Endpoints-Open-Redirect.html
seclists.org
http://seclists.org/fulldisclosure/2014/Dec/35
tetraph.com
http://tetraph.com/security/cves/cve-2014-8489-ping-identity-corporation-pingfederate-6-10-1-sp-endpoints-dest-redirect-privilege-escalation-security-vulnerability/
More from Pingfederate
9.8
CVE-2023-40545
PingFederate OAuth client_secret_jwt Authentication Bypass
9.8
CVE-2023-37283
Authentication Bypass via HTML Form & Identifier First Adapter
9.8
CVE-2021-40329
The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management
8.8
CVE-2022-40724
Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.
7.5
CVE-2023-39219
Admin Console Denial of Service via Java class enumeration