RSA Federated Identity Manager URI Redirection Vulnerability

Bugtraq ID:	41850
Class:	Input Validation Error
CVE:	CVE-2010-2337
Remote:	Yes
Local:	No
Published:	Jul 21 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	Reported by the vendor
Vulnerable:	Rsa Federated Identity Manager 4.1 Rsa Federated Identity Manager 4.0
Not Vulnerable:	Rsa Federated Identity Manager 4.1.26 Rsa Federated Identity Manager 4.0.25

RSA Federated Identity Manager URI Redirection Vulnerability

RSA Federated Identity Manager is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

RSA Federated Identity Manager 4.0 and 4.1 are vulnerable.

RSA Federated Identity Manager URI Redirection Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to following a malicious URI.

RSA Federated Identity Manager URI Redirection Vulnerability

Solution:
Updates are available. Please see the references for more information.

RSA Federated Identity Manager URI Redirection Vulnerability

References:

• RSA Federated Identity Manager Homepage (RSA Security)