CVE-2014-2880

Published: Apr 17, 2014Modified: May 6, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backUrl parameter in a changepwd action to identity/faces/firstlogin.

Affected (1)

Products: Oracle: Identity Manager

1 product

Identity Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Identity Manager	Version 11.1.2.1.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (10)

http://packetstormsecurity.com/files/125992/Oracle-Identity-Manager-11g-R2-SP1-Unvalidated-Redirect.html

Source: cve@mitre.org

http://www.exploit-db.com/exploits/32670

Source: cve@mitre.org

http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html

Source: cve@mitre.org

http://www.osvdb.org/105384

Source: cve@mitre.org

http://www.securityfocus.com/bid/66615

Source: cve@mitre.org

http://packetstormsecurity.com/files/125992/Oracle-Identity-Manager-11g-R2-SP1-Unvalidated-Redirect.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.exploit-db.com/exploits/32670

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/105384

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/66615

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.