CVEvulnerability
CVE-2011-1386
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-01-04
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
IBM Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1, 6.2.0, and 6.2.1 do not properly handle signature validations based on SAML 1.0, 1.1, and 2.0, which allows remote attackers to bypass intended authentication or authorization requirements via a non-conforming SAML signature.
Affected configurations
• ibm tivoli federated identity manager 6.1.1
• ibm tivoli federated identity manager 6.2.0
• ibm tivoli federated identity manager 6.2.1
• ibm tivoli federated identity manager business gateway 6.1.1
• ibm tivoli federated identity manager business gateway 6.2.0
• ibm tivoli federated identity manager business gateway 6.2.1
Related
Weakness · not in database (1)
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV10793 Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV10801 www-01.ibm.com
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV10813 www-01.ibm.com
- http://www.ibm.com/support/docview.wss?uid=swg21575309 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71686 exchange.xforce.ibmcloud.com
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV10793 Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV10801 www-01.ibm.com
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV10813 www-01.ibm.com
- http://www.ibm.com/support/docview.wss?uid=swg21575309 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71686 exchange.xforce.ibmcloud.com