4.3

CVE-2012-6359

IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2.2 before 6.2.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2.2 before 6.2.2.2 do not check whether an OpenID attribute is signed in the (1) SREG (aka simple registration extension) and (2) AX (aka attribute exchange extension) cases, which allows man-in-the-middle attackers to spoof OpenID provider data by inserting unsigned attributes.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.13% 0.622
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://secunia.com/advisories/51212
http://www-01.ibm.com/support/docview.wss?uid=swg1IV23451
http://www-01.ibm.com/support/docview.wss?uid=swg1IV23452
http://www-01.ibm.com/support/docview.wss?uid=swg1IV23453
http://www-01.ibm.com/support/docview.wss?uid=swg21615744
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21615748
Vendor Advisory
http://www.securityfocus.com/bid/56390
https://exchange.xforce.ibmcloud.com/vulnerabilities/77790