Vulnerability · Published Oct 29, 2024 · Assigned by Ping Identity
CVE-2024-25566Open Redirect in PingAM
Medium 5.1
In plain English
A medium-severity open redirect in PingAM from Ping Identity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.2%top 84.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to redirect end-users to malicious sites under their control, simplifying phishing attacks
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ping Identity | PingAM | 7.5.07.4.0 – through 7.4.17.3.0 – through 7.3.17.2.0 – through 7.2.27.1.0 – through 7.1.40 – through 7.0.2 |
Weakness: CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N