CVE-2014-8489

Name of the Vulnerable Software and Affected Versions PingFederate version 6.10.1

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the TargetResource parameter in the startSSO.ping endpoint.

Recommendations For PingFederate version 6.10.1, consider restricting access to the startSSO.ping endpoint to minimize the risk of exploitation. Avoid using the TargetResource parameter in this endpoint until the issue is resolved.