XML Parsing Vulnerability in IBM SAML-Based Single Sign-On Systems
CVE-2018-1443

5.9MEDIUM

Key Information:

Vendor
IBM
Status
Security Access Manager
Tivoli Federated Identity Manager
Vendor
CVE Published:
8 March 2018

Summary

An XML parsing vulnerability in IBM's SAML-based single sign-on (SSO) systems can enable an authenticated attacker to manipulate the SAML authentication process, potentially leading to unauthorized access as a different user without needing to know the victim's password. This flaw primarily affects IBM Security Access Manager (versions 9.0.0 to 9.0.4) and IBM Tivoli Federated Identity Manager (versions 6.0.2 to 6.2). For more information, refer to the IBM X-Force ID: 139754.

Affected Version(s)

Security Access Manager 9.0.0.1

Security Access Manager 9.0.0

Security Access Manager 9.0.1.0

References

http://www.securitytracker.com/id/1040454
vdb-entryx_refsource_SECTRACK
http://www.securitytracker.com/id/1040455
vdb-entryx_refsource_SECTRACK
https://exchange.xforce.ibmcloud.com/vulnerabilities/139754
vdb-entryx_refsource_XF

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.