CVEvulnerability

CVE-2013-5429

2.1 LOW Published 2014-01-21 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2014-01-21
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
2.1 LOW — AV:N/AC:H/Au:S/C:N/I:P/A:N
Weaknesses
CWE-287

Description

The Risk Based Access functionality in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.2 before FP9 does not prevent reuse of One Time Password (OTP) tokens, which makes it easier for remote authenticated users to complete transactions by leveraging access to an already-used token.

Affected configurations

• ibm tivoli federated identity manager 6.2.2 • ibm tivoli federated identity manager 6.2.2.1 • ibm tivoli federated identity manager 6.2.2.2 • ibm tivoli federated identity manager 6.2.2.3 • ibm tivoli federated identity manager 6.2.2.4 • ibm tivoli federated identity manager 6.2.2.5 • ibm tivoli federated identity manager 6.2.2.6 • ibm tivoli federated identity manager 6.2.2.7 • ibm tivoli federated identity manager 6.2.2.8

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References