OpenID Attribute Spoofing Vulnerability in IBM Tivoli Federated Identity Manager
CVE-2012-6359

Currently unrated

Key Information:

Vendor
IBM
Status
Tivoli Federated Identity Manager
Vendor
CVE Published:
18 January 2013

Summary

IBM Tivoli Federated Identity Manager and its Business Gateway versions prior to the specified updates lack proper validation for OpenID attributes in SREG and AX cases. This security flaw allows man-in-the-middle attackers to send unsigned attributes, potentially compromising OpenID provider data and facilitating unauthorized impersonation.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/77790
vdb-entryx_refsource_XF
http://secunia.com/advisories/51212
third-party-advisoryx_refsource_SECUNIA
http://www-01.ibm.com/support/docview.wss?uid=swg1IV23452
vendor-advisoryx_refsource_AIXAPAR

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.