Description
siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder does not ensure that the TARGET parameter names a valid redirection resource, which allows remote attackers to construct a URL that might trick users into visiting an arbitrary web site referenced by this parameter.
References
- [curl-users] 20030529 Re: https, redirection and authentication using POST mailing-list
- 30741 vdb-entry