Lucene search

IbmCVE-2018-1443

HistoryMar 08, 2018 - 4:29 p.m.

CVE-2018-1443

2018-03-0816:29:00

CWE-287

ibm

web.nvd.nist.gov

ibm

saml

sso

xml parsing

vulnerability

unauthorized access

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

5.9

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

5.4

Confidence

High

EPSS

0.002

Percentile

51.7%

JSON

An XML parsing vulnerability affects IBM SAML-based single sign-on (SSO) systems (IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2.) This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a different user without knowledge of the victim users password. IBM X-Force ID: 139754.

Affected configurations

Nvd

Vulners

Node

ibmsecurity_access_managerRange9.0.0–9.0.4

Node

ibmtivoli_federated_identity_managerMatch6.2.0

ibmtivoli_federated_identity_managerMatch6.2.1

ibmtivoli_federated_identity_managerMatch6.2.2

VendorProductVersionCPE
ibmsecurity_access_manager*cpe:2.3:a:ibm:security_access_manager:*:*:*:*:*:*:*:*
ibmtivoli_federated_identity_manager6.2.0cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.0:*:*:*:*:*:*:*
ibmtivoli_federated_identity_manager6.2.1cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.1:*:*:*:*:*:*:*
ibmtivoli_federated_identity_manager6.2.2cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	security_access_manager	*	cpe:2.3:a:ibm:security_access_manager::::::::
ibm	tivoli_federated_identity_manager	6.2.0	cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.0:::::::*
ibm	tivoli_federated_identity_manager	6.2.1	cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.1:::::::*
ibm	tivoli_federated_identity_manager	6.2.2	cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.2:::::::*

CNA Affected

[
  {
    "product": "Security Access Manager",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "9.0.0.1"
      },
      {
        "status": "affected",
        "version": "9.0.0"
      },
      {
        "status": "affected",
        "version": "9.0.1.0"
      },
      {
        "status": "affected",
        "version": "9.0.2.0"
      },
      {
        "status": "affected",
        "version": "9.0.2.1"
      },
      {
        "status": "affected",
        "version": "9.0.3"
      },
      {
        "status": "affected",
        "version": "9.0.3.1"
      },
      {
        "status": "affected",
        "version": "9.0.4"
      }
    ]
  },
  {
    "product": "Tivoli Federated Identity Manager",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "6.2.1"
      },
      {
        "status": "affected",
        "version": "6.2"
      },
      {
        "status": "affected",
        "version": "6.2.2"
      }
    ]
  }
]

References

www.ibm.com/support/docview.wss?uid=swg22014160

www.ibm.com/support/docview.wss?uid=swg22014161

www.securityfocus.com/bid/103365

www.securitytracker.com/id/1040454

www.securitytracker.com/id/1040455

exchange.xforce.ibmcloud.com/vulnerabilities/139754

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

5.9

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

5.4

Confidence

High

EPSS

0.002

Percentile

51.7%

JSON

Related for CVE-2018-1443