CVE-2014-8894 - Open redirect vulnerability in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3

CVE-2014-8894

Summary

Open redirect vulnerability in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the out parameter. <a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a>

References

Vulnerable Configurations

cpe:2.3:a:ibm:tririga_application_platform:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:3.3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:3.3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:3.3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:3.3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:3.3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:3.3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:3.4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:3.4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:3.4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:3.4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:3.4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:3.4.1.0:*:*:*:*:*:*:*

CVSS

Base:	4.9 (as of 08-09-2017 - 01:29)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	SINGLE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:S/C:P/I:P/A:N

refmap via4

bid	72408
confirm	http://www-01.ibm.com/support/docview.wss?uid=swg21694772
secunia	62674
xf	ibm-tririga-cve20148894-redirect(99013)

Last major update

08-09-2017 - 01:29

Published

29-01-2015 - 01:59

Last modified

08-09-2017 - 01:29