CVE-2012-3315

CWE-287 — Improper Authentication3 documents3 sources

Severity

5.0MEDIUM

EPSS

0.4%

top 39.00%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Tivoli Federated Identity Manager IBM Tivoli Federated Identity Manager Business Gateway

Timeline

PublishedNov 8

Latest updateMay 17

Description

The Java servlets in the management console in IBM Tivoli Federated Identity Manager (TFIM) through 6.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE security constraints, and obtain sensitive information related to (1) federation metadata or (2) a web plugin configuration template, via a crafted request.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶NVDibm/tivoli_federated_identity_manager_business_gateway6.2.1+6

▶NVDibm/tivoli_federated_identity_manager6.2.2+8

🔴Vulnerability Details

GHSA

GHSA-v5cp-96cw-fp58: The Java servlets in the management console in IBM Tivoli Federated Identity Manager (TFIM) through 6↗2022-05-17

▶

CVEList

CVE-2012-3315: The Java servlets in the management console in IBM Tivoli Federated Identity Manager (TFIM) through 6↗2012-11-08

▶