Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 02/10/2012 Updated: 01/02/2013

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

IBM Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1, 6.2.0, 6.2.1, and 6.2.2 allow remote malicious users to establish sessions via a crafted message that leverages (1) a signature-validation bypass for SAML messages containing unsigned elements, (2) incorrect validation of XML messages, or (3) a certificate-chain validation bypass for an XML signature element that contains the signing certificate.

Vulnerable Product	Search on Vulmon	Subscribe to Product
ibm tivoli federated identity manager 6.2.1
ibm tivoli federated identity manager 6.2.2
ibm tivoli federated identity manager 6.1.1
ibm tivoli federated identity manager 6.2.0
ibm tivoli federated identity manager business gateway 6.2.0
ibm tivoli federated identity manager business gateway 6.2.1
ibm tivoli federated identity manager business gateway 6.1.1
ibm tivoli federated identity manager business gateway 6.2.2

CWE-20 http://www-01.ibm.com/support/docview.wss?uid=swg21612612 http://www-01.ibm.com/support/docview.wss?uid=swg1IV23445 http://www-01.ibm.com/support/docview.wss?uid=swg1IV23448 http://www-01.ibm.com/support/docview.wss?uid=swg1IV23442 http://www-01.ibm.com/support/docview.wss?uid=swg1IV23435 http://www.securityfocus.com/bid/55732 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2012-3314

Vulnerability Summary

References

Vulmon Search

About

Products

Connect