CVE

Id
56558  
CVE No.
CVE-2012-3315  
Status
Candidate  
Description
The Java servlets in the management console in IBM Tivoli Federated Identity Manager (TFIM) through 6.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE security constraints, and obtain sensitive information related to (1) federation metadata or (2) a web plugin configuration template, via a crafted request.  
Phase
Assigned (20120607)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
585709 56558 CVE-2012-3315 CONFIRM:http://www-01.ibm.com/support/docview.wss?uid=swg21615770  View
585710 56558 CVE-2012-3315 CONFIRM:http://www-01.ibm.com/support/docview.wss?uid=swg21615772  View
585711 56558 CVE-2012-3315 AIXAPAR:IV26825  View
585712 56558 CVE-2012-3315 URL:http://www-01.ibm.com/support/docview.wss?uid=swg1IV26825  View
585713 56558 CVE-2012-3315 AIXAPAR:IV26826  View
585714 56558 CVE-2012-3315 URL:http://www-01.ibm.com/support/docview.wss?uid=swg1IV26826  View
585715 56558 CVE-2012-3315 AIXAPAR:IV26827  View
585716 56558 CVE-2012-3315 URL:http://www-01.ibm.com/support/docview.wss?uid=swg1IV26827  View
585717 56558 CVE-2012-3315 SECUNIA:51163  View
585718 56558 CVE-2012-3315 URL:http://secunia.com/advisories/51163  View
585719 56558 CVE-2012-3315 XF:tfim-mcs-unauth-access(77796)  View

Related JVN