IBM Tivoli Federated Identity Manager/Business Gateway Open Redirection Vulnerability
BID:63396
Info
IBM Tivoli Federated Identity Manager/Business Gateway Open Redirection Vulnerability
| Bugtraq ID: | 63396 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-5431 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 28 2013 12:00AM |
| Updated: | Oct 28 2013 12:00AM |
| Credit: | IBM |
| Vulnerable: |
IBM Tivoli Federated Identity Manager Business Gateway 6.3 IBM Tivoli Federated Identity Manager Business Gateway 6.2.1 IBM Tivoli Federated Identity Manager Business Gateway 6.1.1 IBM Tivoli Federated Identity Manager 6.3 |
| Not Vulnerable: | |
Discussion
IBM Tivoli Federated Identity Manager/Business Gateway Open Redirection Vulnerability
IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway are prone to an open-redirection vulnerability.
An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.
Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) versions 6.1.1, 6.2.0, 6.2.1, and 6.2.2 are affected.
IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway are prone to an open-redirection vulnerability.
An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.
Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) versions 6.1.1, 6.2.0, 6.2.1, and 6.2.2 are affected.
Exploit / POC
IBM Tivoli Federated Identity Manager/Business Gateway Open Redirection Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to following a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting victim to following a malicious URI.
Solution / Fix
IBM Tivoli Federated Identity Manager/Business Gateway Open Redirection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
IBM Tivoli Federated Identity Manager/Business Gateway Open Redirection Vulnerability
References:
References: