CVE-2013-5429

2014-01-2101:55:03

CWE-287

[email protected]

web.nvd.nist.gov

ibm

tivoli

federated identity manager

tfim

tfimbg

cve-2013-5429

risk based access

otp

security vulnerability

6.2 Medium

AI Score

Confidence

Low

2.1 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

49.5%

JSON

The Risk Based Access functionality in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.2 before FP9 does not prevent reuse of One Time Password (OTP) tokens, which makes it easier for remote authenticated users to complete transactions by leveraging access to an already-used token.

Affected configurations

NVD

Node

ibmtivoli_federated_identity_managerMatch6.2.2

ibmtivoli_federated_identity_managerMatch6.2.2.1

ibmtivoli_federated_identity_managerMatch6.2.2.2

ibmtivoli_federated_identity_managerMatch6.2.2.3

ibmtivoli_federated_identity_managerMatch6.2.2.4

ibmtivoli_federated_identity_managerMatch6.2.2.5

ibmtivoli_federated_identity_managerMatch6.2.2.6

ibmtivoli_federated_identity_managerMatch6.2.2.7

ibmtivoli_federated_identity_managerMatch6.2.2.8

CPENameOperatorVersion
ibm:tivoli_federated_identity_manageribm tivoli federated identity managereq6.2.2
ibm:tivoli_federated_identity_manageribm tivoli federated identity managereq6.2.2.1
ibm:tivoli_federated_identity_manageribm tivoli federated identity managereq6.2.2.2
ibm:tivoli_federated_identity_manageribm tivoli federated identity managereq6.2.2.3
ibm:tivoli_federated_identity_manageribm tivoli federated identity managereq6.2.2.4
ibm:tivoli_federated_identity_manageribm tivoli federated identity managereq6.2.2.5
ibm:tivoli_federated_identity_manageribm tivoli federated identity managereq6.2.2.6
ibm:tivoli_federated_identity_manageribm tivoli federated identity managereq6.2.2.7
ibm:tivoli_federated_identity_manageribm tivoli federated identity managereq6.2.2.8

CPE	Name	Operator	Version
ibm:tivoli_federated_identity_manager	ibm tivoli federated identity manager	eq	6.2.2
ibm:tivoli_federated_identity_manager	ibm tivoli federated identity manager	eq	6.2.2.1
ibm:tivoli_federated_identity_manager	ibm tivoli federated identity manager	eq	6.2.2.2
ibm:tivoli_federated_identity_manager	ibm tivoli federated identity manager	eq	6.2.2.3
ibm:tivoli_federated_identity_manager	ibm tivoli federated identity manager	eq	6.2.2.4
ibm:tivoli_federated_identity_manager	ibm tivoli federated identity manager	eq	6.2.2.5
ibm:tivoli_federated_identity_manager	ibm tivoli federated identity manager	eq	6.2.2.6
ibm:tivoli_federated_identity_manager	ibm tivoli federated identity manager	eq	6.2.2.7
ibm:tivoli_federated_identity_manager	ibm tivoli federated identity manager	eq	6.2.2.8