CVE-2014-8489 | Vulnerability Database | Aqua Security

Open redirect vulnerability in startSSO.ping in the SP Endpoints in Ping Identity PingFederate 6.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the TargetResource parameter.

Affected Software

Name	Vendor	Start Version	End Version
Pingfederate	Pingidentity	6.10.1 (including)	6.10.1 (including)

References

http://packetstormsecurity.com/files/129454/PingFederate-6.10.1-SP-Endpoints-Open-Redirect.html
http://seclists.org/fulldisclosure/2014/Dec/35
http://tetraph.com/security/cves/cve-2014-8489-ping-identity-corporation-pingfederate-6-10-1-sp-endpoints-dest-redirect-privilege-escalation-security-vulnerability/
http://packetstormsecurity.com/files/129454/PingFederate-6.10.1-SP-Endpoints-Open-Redirect.html
http://seclists.org/fulldisclosure/2014/Dec/35
http://tetraph.com/security/cves/cve-2014-8489-ping-identity-corporation-pingfederate-6-10-1-sp-endpoints-dest-redirect-privilege-escalation-security-vulnerability/

NVD	https://nvd.nist.gov/vuln/detail/CVE-2014-8489
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html