CVEvulnerability

CVE-2012-3315

5.0 MEDIUM Published 2012-11-08 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-11-08
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-287

Description

The Java servlets in the management console in IBM Tivoli Federated Identity Manager (TFIM) through 6.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE security constraints, and obtain sensitive information related to (1) federation metadata or (2) a web plugin configuration template, via a crafted request.

Affected configurations

• ibm tivoli federated identity manager (<= 6.2.2) • ibm tivoli federated identity manager 6.1.1 • ibm tivoli federated identity manager 6.2.0 • ibm tivoli federated identity manager 6.2.0.1 • ibm tivoli federated identity manager 6.2.0.2 • ibm tivoli federated identity manager 6.2.0.3 • ibm tivoli federated identity manager 6.2.0.8 • ibm tivoli federated identity manager 6.2.0.9 • ibm tivoli federated identity manager 6.2.1 • ibm tivoli federated identity manager business gateway (<= 6.2.1) • ibm tivoli federated identity manager business gateway 6.1.1 • ibm tivoli federated identity manager business gateway 6.2.0 • ibm tivoli federated identity manager business gateway 6.2.0.1 • ibm tivoli federated identity manager business gateway 6.2.0.2 • ibm tivoli federated identity manager business gateway 6.2.0.3 • ibm tivoli federated identity manager business gateway 6.2.0.8

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References