CVE-2012-6359: ibm tivoli_federated_identity_manager
Vulnerability summary
CVE-2012-6359 is a medium (CVSS 4.3) vulnerability in ibm tivoli_federated_identity_manager. EPSS estimates a 1.13% chance of exploitation in the next 30 days, higher than 66.1% of scored vulnerabilities.
Timeline
- 18-01-2013PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2.2 before 6.2.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2.2 before 6.2.2.2 do not check whether an OpenID attribute is signed in the (1) SREG (aka simple registration extension) and (2) AX (aka attribute exchange extension) cases, which allows man-in-the-middle attackers to spoof OpenID provider data by inserting unsigned attributes.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.13%
Chance of exploitation in the next 30 days
Percentile
66%
Versus all other CVEs
30-day change
0.00 pp
From 1.13% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ibm2 products
- tivoli_federated_identity_manager6.2.0 | 6.2.0.1 | 6.2.0.2 | 6.2.0.3 | 6.2.0.8 | 6.2.0.9 | 6.2.0.10 | 6.2.1 | 6.2.1.1 | 6.2.1.2 | 6.2.2
- tivoli_federated_identity_manager_business_gateway6.2.0 | 6.2.0.1 | 6.2.0.2 | 6.2.0.3 | 6.2.0.8 | 6.2.0.9 | 6.2.0.10 | 6.2.1 | 6.2.2
1 vendor · 2 products