CVE-2008-7299

CWE-20 — Improper Input Validation3 documents3 sources

Severity

5.0MEDIUM

EPSS

0.2%

top 54.83%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Tivoli Federated Identity Manager

Timeline

PublishedAug 12

Latest updateMay 17

Description

IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2 uses an incomplete SAML 1.x browser-artifact, which allows remote OpenID providers to spoof assertions via vectors related to the Issuer field.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

▶NVDibm/tivoli_federated_identity_manager6.2.0, 6.2.0.1+1

🔴Vulnerability Details

GHSA

GHSA-x2wr-2x34-4hqr: IBM Tivoli Federated Identity Manager (TFIM) 6↗2022-05-17

▶

CVEList

CVE-2008-7299: IBM Tivoli Federated Identity Manager (TFIM) 6↗2011-08-12

▶