CVE-2012-3314: ibm tivoli_federated_identity_manager Improper Input Validation

Vulnerability summary

CVE-2012-3314 is a medium (CVSS 5.8) Improper Input Validation vulnerability in ibm tivoli_federated_identity_manager. EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 57.2% of scored vulnerabilities.

Timeline

1. 02-10-2012
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

IBM Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1, 6.2.0, 6.2.1, and 6.2.2 allow remote attackers to establish sessions via a crafted message that leverages (1) a signature-validation bypass for SAML messages containing unsigned elements, (2) incorrect validation of XML messages, or (3) a certificate-chain validation bypass for an XML signature element that contains the signing certificate.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.