Lucene search

IbmCVE-2014-3097

HistoryOct 02, 2014 - 12:55 a.m.

CVE-2014-3097

2014-10-0200:55:03

ibm

web.nvd.nist.gov

cve-2014-3097

open redirect

vulnerability

ibm tivoli federated identity manager

tfim

phishing攴

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

6.7

Confidence

Low

EPSS

0.005

Percentile

75.5%

JSON

Open redirect vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0-TIV-TFIM-IF0015, 6.2.1 before 6.2.1-TIV-TFIM-IF0007, and 6.2.2 before 6.2.2-TIV-TFIM-IF0011 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Affected configurations

Nvd

Node

ibmtivoli_federated_identity_managerMatch6.2.0

ibmtivoli_federated_identity_managerMatch6.2.1

ibmtivoli_federated_identity_managerMatch6.2.2

VendorProductVersionCPE
ibmtivoli_federated_identity_manager6.2.0cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.0:*:*:*:*:*:*:*
ibmtivoli_federated_identity_manager6.2.1cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.1:*:*:*:*:*:*:*
ibmtivoli_federated_identity_manager6.2.2cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	tivoli_federated_identity_manager	6.2.0	cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.0:::::::*
ibm	tivoli_federated_identity_manager	6.2.1	cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.1:::::::*
ibm	tivoli_federated_identity_manager	6.2.2	cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.2:::::::*

References

www-01.ibm.com/support/docview.wss?uid=swg1IV64324

www-01.ibm.com/support/docview.wss?uid=swg1IV64325

www-01.ibm.com/support/docview.wss?uid=swg1IV64349

www-01.ibm.com/support/docview.wss?uid=swg1IV64376

www-01.ibm.com/support/docview.wss?uid=swg1IV64494

www-01.ibm.com/support/docview.wss?uid=swg1IV64497

www-01.ibm.com/support/docview.wss?uid=swg1IV64501

www-01.ibm.com/support/docview.wss?uid=swg1IV64506

www-01.ibm.com/support/docview.wss?uid=swg1IV64509

www-01.ibm.com/support/docview.wss?uid=swg1IV64511

www-01.ibm.com/support/docview.wss?uid=swg1IV64512

www-01.ibm.com/support/docview.wss?uid=swg21684852

exchange.xforce.ibmcloud.com/vulnerabilities/94265

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

6.7

Confidence

Low

EPSS

0.005

Percentile

75.5%

JSON

Related for CVE-2014-3097