CVE-2009-5083

Published: Aug 12, 2011Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when configured as an OpenID relying party, does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, which allows remote attackers to bypass authentication via unspecified vectors.

Affected (2)

Products: Ibm: Tivoli Federated Identity Manager

1 product

Tivoli Federated Identity Manager

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Ibm Tivoli Federated Identity Manager	Version 6.2.0.1
Ibm Tivoli Federated Identity Manager	Version 6.2.0

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

http://www-01.ibm.com/support/docview.wss?uid=swg1IZ44571

Source: cve@mitre.org

http://www.ibm.com/support/docview.wss?uid=swg24029497

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg1IZ44571

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ibm.com/support/docview.wss?uid=swg24029497

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.