NVD

Id
47130  
Name
CVE-2012-6359  
Description
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2.2 before 6.2.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2.2 before 6.2.2.2 do not check whether an OpenID attribute is signed in the (1) SREG (aka simple registration extension) and (2) AX (aka attribute exchange extension) cases, which allows man-in-the-middle attackers to spoof OpenID provider data by inserting unsigned attributes.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2013-01-18  
Modified Date
2013-04-10  
Seq
2012-6359  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
235951 47130 CVE-2012-6359 IV23451  View
235952 47130 CVE-2012-6359 IV23452  View
235953 47130 CVE-2012-6359 IV23453  View
235954 47130 CVE-2012-6359 http://www-01.ibm.com/support/docview.wss?uid=swg21615744  View
235955 47130 CVE-2012-6359 http://www-01.ibm.com/support/docview.wss?uid=swg21615748  View
235956 47130 CVE-2012-6359 56390  View
235957 47130 CVE-2012-6359 tfim-openid-weak-security(77790)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19642 JVNDB-2013-001217 IBM TFIM および TFIMBG における OpenID プロバイダのデータを偽造される脆弱性 IBM Tivoli Federated Identity Manager (TFIM) および Tivoli Federated Identity Manager Business Gateway (TFIMBG) は、OpenID 属性が (1) SREG および (2) AX に署名されているかどうかをチェックしないため、OpenID プロバイダのデータを偽造される脆弱性が存在します。 CVE-2012-6359 59597 CVE-2012-6359 47130 4.3 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001217.html 2013-01-18 2013-01-22 View