CVE-2014-0961
Summary
| CVE | CVE-2014-0961 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-06-08 18:55:05 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Cross-site request forgery (CSRF) vulnerability in IBM Tivoli Identity Manager (ITIM) 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager (ISIM) 6.0 before 6.0.0.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
SingleConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:S/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ibm | Security Identity Manager | 6.0.0 | All | All | All |
| Application | Ibm | Security Identity Manager | 6.0.0.1 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.0.0 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.0.0.10 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.0.0.11 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.0.0.12 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.0.0.13 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.0.0.14 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.0.0.6 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.1.0 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.1.0.10 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.1.0.11 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.1.0.12 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.1.0.13 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.1.0.14 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.1.0.3 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.1.0.4 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.1.0.5 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.1.0.6 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.1.0.7 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.1.0.8 | All | All | All |
| Application | Ibm | Tivoli Identity Manager | 5.1.0.9 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Advisory SA59080 - IBM Tivoli Identity Manager / Security Identity Manager Cross-Site Request Forgery Vulnerability - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| IBM Tivoli Identity Manager and Security Identity Manager Cross Site Request Forgery Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Security Bulletin: IBM Tivoli Identity Manager and IBM Security Identity Manager can be affected by a Cross Site Request Forgery Vulnerability (CVE-2014-0961) | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Vendor Advisory |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.