IBM Security Access Manager CVE-2017-1489 Local Open Redirection Vulnerability
BID:100592
CVE-2017-1489 |Info
IBM Security Access Manager CVE-2017-1489 Local Open Redirection Vulnerability
| Bugtraq ID: | 100592 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-1489 |
| Remote: | No |
| Local: | Yes |
| Published: | Aug 23 2017 12:00AM |
| Updated: | Aug 23 2017 12:00AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
IBM Tivoli Access Manager for e-business 6.1 IBM Tivoli Access Manager for e-business 6.1.1 IBM Tivoli Access Manager for e-business 6.1.0.5 IBM Tivoli Access Manager for e-business 6.1 IBM Security Access Manager for Web 8.0.1 IBM Security Access Manager for Web 8.0 3 IBM Security Access Manager for Web 8.0 2 IBM Security Access Manager for Web 8.0.1.5 IBM Security Access Manager for Web 8.0.1.4 IBM Security Access Manager for Web 8.0.1.3 IBM Security Access Manager for Web 8.0.1.2 IBM Security Access Manager for Web 8.0.1.1 IBM Security Access Manager for Web 8.0.1.0 IBM Security Access Manager for Web 8.0.0.5 IBM Security Access Manager for Web 8.0.0.4 IBM Security Access Manager for Web 8.0.0.0 IBM Security Access Manager for Web 7.0.0.20 IBM Security Access Manager for Web 7.0.0.18 IBM Security Access Manager for Web 7.0.0.17 IBM Security Access Manager for Web 7.0.0.16 IBM Security Access Manager for Web 7.0.0.15 IBM Security Access Manager for Web 7.0.0.14 IBM Security Access Manager for Web 7.0.0.13 IBM Security Access Manager for Web 7.0.0.12 IBM Security Access Manager for Web 7.0.0.11 IBM Security Access Manager for Web 7.0.0.10 IBM Security Access Manager for Mobile 8.0.1 IBM Security Access Manager for Mobile 8.0.1.5 IBM Security Access Manager for Mobile 8.0.1.4 IBM Security Access Manager for Mobile 8.0.1.3 IBM Security Access Manager for Mobile 8.0.1.2 IBM Security Access Manager for Mobile 8.0.1.1 IBM Security Access Manager for Mobile 8.0.0.5 IBM Security Access Manager for Mobile 8.0.0.4 IBM Security Access Manager for Mobile 8.0.0.3 IBM Security Access Manager for Mobile 8.0.0.2 IBM Security Access Manager for Mobile 8.0.0.1 IBM Security Access Manager for Mobile 8.0.0.0 IBM Security Access Manager 9.0.3.0 IBM Security Access Manager 9.0.2.0 IBM Security Access Manager 9.0.1.0 IBM Security Access Manager 9.0 |
| Not Vulnerable: | |
Discussion
IBM Security Access Manager CVE-2017-1489 Local Open Redirection Vulnerability
IBM Security Access Manager is prone to a local open-redirection vulnerability.
An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.
IBM Security Access Manager is prone to a local open-redirection vulnerability.
An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.
Exploit / POC
IBM Security Access Manager CVE-2017-1489 Local Open Redirection Vulnerability
To exploit this issue an attacker must entice an unsuspecting user to follow a malicious URI.
To exploit this issue an attacker must entice an unsuspecting user to follow a malicious URI.