← Back to CVEs
CVE-2012-3315
N/ADescription
The Java servlets in the management console in IBM Tivoli Federated Identity Manager (TFIM) through 6.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE security constraints, and obtain sensitive information related to (1) federation metadata or (2) a web plugin configuration template, via a crafted request.
CVE Details
CVSS v3.1 ScoreN/A
Published11/8/2012
Last Modified4/11/2025
Sourcenvd
Honeypot Sightings0
Affected Products
ibm:tivoli_federated_identity_manageribm:tivoli_federated_identity_manager_business_gateway
Weaknesses (CWE)
CWE-287
References
http://secunia.com/advisories/51163(psirt@us.ibm.com)
http://www-01.ibm.com/support/docview.wss?uid=swg1IV26825(psirt@us.ibm.com)
http://www-01.ibm.com/support/docview.wss?uid=swg1IV26826(psirt@us.ibm.com)
http://www-01.ibm.com/support/docview.wss?uid=swg1IV26827(psirt@us.ibm.com)
http://www-01.ibm.com/support/docview.wss?uid=swg21615770(psirt@us.ibm.com)
http://www-01.ibm.com/support/docview.wss?uid=swg21615772(psirt@us.ibm.com)
https://exchange.xforce.ibmcloud.com/vulnerabilities/77796(psirt@us.ibm.com)
http://secunia.com/advisories/51163(af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?uid=swg1IV26825(af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?uid=swg1IV26826(af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?uid=swg1IV26827(af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?uid=swg21615770(af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?uid=swg21615772(af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/77796(af854a3a-2127-422b-91ae-364da2661108)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.