« Volver al listado

CVE-2024-25566

Estado: AnalizadaMedia (5.1)—

An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to redirect end-users to malicious sites under their control, simplifying phishing attacks

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Forgerock — Access Management

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-25566",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-25566",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-29T19:58:14.725482Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "responsible-disclosure@pingidentity.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "ACTIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "responsible-disclosure@pingidentity.com",
      "affectedData": [
        {
          "vendor": "Ping Identity",
          "product": "PingAM",
          "versions": [
            {
              "status": "affected",
              "version": "7.5.0",
              "versionType": "major release"
            },
            {
              "status": "affected",
              "version": "7.4.0",
              "versionType": "maintenance release",
              "lessThanOrEqual": "7.4.1"
            },
            {
              "status": "affected",
              "version": "7.3.0",
              "versionType": "maintenance release",
              "lessThanOrEqual": "7.3.1"
            },
            {
              "status": "affected",
              "version": "7.2.0",
              "versionType": "maintenance release",
              "lessThanOrEqual": "7.2.2"
            },
            {
              "status": "affected",
              "version": "7.1.0",
              "versionType": "maintenance release",
              "lessThanOrEqual": "7.1.4"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "maintenance release",
              "lessThanOrEqual": "7.0.2"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-10-29T16:15:04.947",
  "references": [
    {
      "url": "https://backstage.forgerock.com/downloads/browse/am/featured",
      "tags": [
        "Product"
      ],
      "source": "responsible-disclosure@pingidentity.com"
    },
    {
      "url": "https://backstage.forgerock.com/knowledge/advisories/article/a63463303",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "responsible-disclosure@pingidentity.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "responsible-disclosure@pingidentity.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to redirect end-users to malicious sites under their control, simplifying phishing attacks"
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de redireccionamiento abierto en PingAM, en la que las solicitudes bien manipuladas pueden provocar una validación incorrecta de las URL de redireccionamiento. Esto podría permitir que un atacante redirija a los usuarios finales a sitios maliciosos bajo su control, lo que simplifica los ataques de phishing."
    }
  ],
  "lastModified": "2026-06-17T07:16:11.213",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:forgerock:access_management:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FFF5D8C-AF14-4120-BD21-E90C168FDE83",
              "versionEndIncluding": "7.0.2"
            },
            {
              "criteria": "cpe:2.3:a:forgerock:access_management:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4DC330E6-C70E-4035-A894-CE9F6BC4E30A",
              "versionEndIncluding": "7.1.4",
              "versionStartIncluding": "7.1.0"
            },
            {
              "criteria": "cpe:2.3:a:forgerock:access_management:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D9F54DE-CA12-455F-98E3-B0AEC64DF3A3",
              "versionEndIncluding": "7.2.2",
              "versionStartIncluding": "7.2.0"
            },
            {
              "criteria": "cpe:2.3:a:forgerock:access_management:7.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2B38BE7-6A73-400C-B6CC-FED6C0FE7612"
            },
            {
              "criteria": "cpe:2.3:a:forgerock:access_management:7.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A79687F-7972-4032-8694-A4567531292F"
            },
            {
              "criteria": "cpe:2.3:a:forgerock:access_management:7.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1CC06681-7D1B-4F04-80BD-AE5BC3E283BA"
            },
            {
              "criteria": "cpe:2.3:a:forgerock:access_management:7.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C94CD667-557E-476A-8950-2123793CFE4B"
            },
            {
              "criteria": "cpe:2.3:a:forgerock:access_management:7.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C15731F3-5D9E-49B2-85AE-3F220D672031"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "responsible-disclosure@pingidentity.com"
}