CVE-2015-1966

2015-07-0414:59:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2015-1966

ibm

tivoli

federated identity manager

xss

vulnerabilities

fp17

fp9

fp15

security access manager

remote attackers

url

error_description

token

relaystate

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.0%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before FP17, 6.2.1 before FP9, and 6.2.2 before FP15, as used in Security Access Manager for Mobile and other products, allow remote attackers to inject arbitrary web script or HTML via a crafted URL, related to the (1) ERROR_DESCRIPTION and (2) TOKEN:RelayState macros.

Affected configurations

NVD

Node

ibmtivoli_federated_identity_managerMatch6.2.0

ibmtivoli_federated_identity_managerMatch6.2.1

ibmtivoli_federated_identity_managerMatch6.2.2

CPENameOperatorVersion
ibm:tivoli_federated_identity_manageribm tivoli federated identity managereq6.2.0
ibm:tivoli_federated_identity_manageribm tivoli federated identity managereq6.2.1
ibm:tivoli_federated_identity_manageribm tivoli federated identity managereq6.2.2

CPE	Name	Operator	Version
ibm:tivoli_federated_identity_manager	ibm tivoli federated identity manager	eq	6.2.0
ibm:tivoli_federated_identity_manager	ibm tivoli federated identity manager	eq	6.2.1
ibm:tivoli_federated_identity_manager	ibm tivoli federated identity manager	eq	6.2.2