IBM Security Identity Manager CVE-2014-6106 Cross Site Request Forgery Vulnerability

Bugtraq ID:	73167
Class:	Design Error
CVE:	CVE-2014-6106
Remote:	Yes
Local:	No
Published:	Mar 02 2015 12:00AM
Updated:	Mar 23 2017 01:01AM
Credit:	IBM
Vulnerable:	IBM Security Identity Manager 7.0 IBM Security Identity Manager 6.0 IBM Security Identity Manager 5.1
Not Vulnerable:

IBM Security Identity Manager CVE-2014-6106 Cross Site Request Forgery Vulnerability

IBM Security Identity Manager is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

IBM Security Identity Manager CVE-2014-6106 Cross Site Request Forgery Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

IBM Security Identity Manager CVE-2014-6106 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Security Identity Manager CVE-2014-6106 Cross Site Request Forgery Vulnerability

References:

• IBM Homepage (IBM)
  
• IBM WebSphere Application Server Product Page (IBM)
  
• Security Bulletin: Multiple Vulnerabilities fixed in IBM Security Identity Manag (IBM)