CVEvulnerability
CVE-2014-2880
5.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-04-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-20
Description
Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backUrl parameter in a changepwd action to identity/faces/firstlogin.
Affected configurations
• oracle identity manager 11.1.2.1.0
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://packetstormsecurity.com/files/125992/Oracle-Identity-Manager-11g-R2-SP1-Unvalidated-Redirect.html packetstormsecurity.com
- http://www.exploit-db.com/exploits/32670 www.exploit-db.com
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html www.oracle.com
- http://www.osvdb.org/105384 www.osvdb.org
- http://www.securityfocus.com/bid/66615 www.securityfocus.com
- http://packetstormsecurity.com/files/125992/Oracle-Identity-Manager-11g-R2-SP1-Unvalidated-Redirect.html packetstormsecurity.com
- http://www.exploit-db.com/exploits/32670 www.exploit-db.com
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html www.oracle.com
- http://www.osvdb.org/105384 www.osvdb.org
- http://www.securityfocus.com/bid/66615 www.securityfocus.com