CVE-2012-3314

Published: Oct 2, 2012Modified: Apr 29, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

IBM Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1, 6.2.0, 6.2.1, and 6.2.2 allow remote attackers to establish sessions via a crafted message that leverages (1) a signature-validation bypass for SAML messages containing unsigned elements, (2) incorrect validation of XML messages, or (3) a certificate-chain validation bypass for an XML signature element that contains the signing certificate.

Affected (8)

Products: Ibm: Tivoli Federated Identity Manager, Tivoli Federated Identity Manager Business Gateway

Ibm

2 products

Tivoli Federated Identity Manager

Tivoli Federated Identity Manager Business Gateway

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Ibm Tivoli Federated Identity Manager	Version 6.1.1
Ibm Tivoli Federated Identity Manager	Version 6.2.0
Ibm Tivoli Federated Identity Manager	Version 6.2.1
Ibm Tivoli Federated Identity Manager	Version 6.2.2

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Ibm Tivoli Federated Identity Manager Business Gateway	Version 6.1.1
Ibm Tivoli Federated Identity Manager Business Gateway	Version 6.2.0
Ibm Tivoli Federated Identity Manager Business Gateway	Version 6.2.1
Ibm Tivoli Federated Identity Manager Business Gateway	Version 6.2.2