CVE-2018-1443 — Improper Authentication in IBM Security Access Manager

CWE-287 — Improper Authentication3 documents3 sources
Severity
5.9MEDIUMNVD
EPSS
0.1%
top 81.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Security Access ManagerIBM Tivoli Federated Identity Manager
Timeline
PublishedMar 8
Latest updateMay 13

Description

An XML parsing vulnerability affects IBM SAML-based single sign-on (SSO) systems (IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2.) This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a different user without knowledge of the victim users password. IBM X-Force ID: 139754.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 2.5 | Impact: 3.4

Affected Packages4 packages

▶NVDibm/security_access_manager9.0.0 — 9.0.4
▶CVEListV5ibm/security_access_manager8 versions+7
▶CVEListV5ibm/tivoli_federated_identity_manager6.2, 6.2.1, 6.2.2+2
▶NVDibm/tivoli_federated_identity_manager6.2.0, 6.2.1, 6.2.2+2

🔴Vulnerability Details

2
GHSA
GHSA-6cj6-68x7-f44g: An XML parsing vulnerability affects IBM SAML-based single sign-on (SSO) systems (IBM Security Access Manager 9↗2022-05-13
▶
CVEList
CVE-2018-1443: An XML parsing vulnerability affects IBM SAML-based single sign-on (SSO) systems (IBM Security Access Manager 9↗2018-03-08
▶
CVE-2018-1443 — Improper Authentication in IBM | cvebase