Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2012-3315
HistoryNov 08, 2012 - 11:46 a.m.

CVE-2012-3315

2012-11-0811:46:23
CWE-287
[email protected]
web.nvd.nist.gov
15
ibm
tfim
tfimbg
unauthenticated access
information disclosure
cve-2012-3315
nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.6 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

70.9%

JSON

The Java servlets in the management console in IBM Tivoli Federated Identity Manager (TFIM) through 6.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE security constraints, and obtain sensitive information related to (1) federation metadata or (2) a web plugin configuration template, via a crafted request.

Affected configurations

NVD
Node
ibmtivoli_federated_identity_managerRange≤6.2.2
OR
ibmtivoli_federated_identity_managerMatch6.1.1
OR
ibmtivoli_federated_identity_managerMatch6.2.0
OR
ibmtivoli_federated_identity_managerMatch6.2.0.1
OR
ibmtivoli_federated_identity_managerMatch6.2.0.2
OR
ibmtivoli_federated_identity_managerMatch6.2.0.3
OR
ibmtivoli_federated_identity_managerMatch6.2.0.8
OR
ibmtivoli_federated_identity_managerMatch6.2.0.9
OR
ibmtivoli_federated_identity_managerMatch6.2.1
Node
ibmtivoli_federated_identity_manager_business_gatewayRange≤6.2.1
OR
ibmtivoli_federated_identity_manager_business_gatewayMatch6.1.1
OR
ibmtivoli_federated_identity_manager_business_gatewayMatch6.2.0
OR
ibmtivoli_federated_identity_manager_business_gatewayMatch6.2.0.1
OR
ibmtivoli_federated_identity_manager_business_gatewayMatch6.2.0.2
OR
ibmtivoli_federated_identity_manager_business_gatewayMatch6.2.0.3
OR
ibmtivoli_federated_identity_manager_business_gatewayMatch6.2.0.8

Related

nvd 1
prion 1
ibm 2
cvelist 1
nvd
nvd
CVE-2012-3315
2012-11-08 11:46:23
prion
prion
Cross site request forgery (csrf)
2012-11-08 11:46:00
ibm
ibm
Security Bulletin: Tivoli Federated Identity Manager Business Gateway - Unprotected Management Console Servlets (CVE-2012-3315)
2022-09-25 23:13:40
Security Bulletin: Tivoli Federated Identity Manager - Unprotected Management Console Servlets (CVE-2012-3315)
2022-09-26 05:45:55
cvelist
cvelist
CVE-2012-3315
2012-11-08 11:00:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.6 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

70.9%

JSON
Related for CVE-2012-3315
nvd1prion1ibm2cvelist1