nvd-json-data-feeds/CVE-2012/CVE-2012-33xx/CVE-2012-3314.json

{
  "id": "CVE-2012-3314",
  "sourceIdentifier": "psirt@us.ibm.com",
  "published": "2012-10-02T21:55:01.333",
  "lastModified": "2024-11-21T01:40:37.850",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1, 6.2.0, 6.2.1, and 6.2.2 allow remote attackers to establish sessions via a crafted message that leverages (1) a signature-validation bypass for SAML messages containing unsigned elements, (2) incorrect validation of XML messages, or (3) a certificate-chain validation bypass for an XML signature element that contains the signing certificate."
    },
    {
      "lang": "es",
      "value": "IBM Tivoli Federated Identity Manager (TFIM) y Tivoli Federated Identity Manager Business Gateway (TFIMBG) v6.1.1, v6.2.0, v6.2.1, y v6.2.2 permite atacantes remotos establecer sesiones a trav\u00e9s de un mensaje que\r\n aprovecha (1) para evitar una validaci\u00f3n de firma que para mensajes SAML que contienen elementos no firmados, (2) validaci\u00f3n incorrecta de mensajes XML, o (3) evitar la validaci\u00f3n de una cadena de certificados de un elemento XML firmado que contiene la firma del certificado."
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "accessComplexity": "MEDIUM",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "NONE"
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7713A26A-87C9-4BF1-A6D1-89DFD7BF5574"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E508843E-DEA8-433D-AFD5-2730D2745E0B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F674F64E-F51F-4F5E-AFCD-952958E66FE2"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:tivoli_federated_identity_manager:6.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "93F48368-9617-4EE6-BF7A-6873229C0D66"
            }
          ]
        }
      ]
    },
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:tivoli_federated_identity_manager_business_gateway:6.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "58E139B7-C2A2-4505-A384-8C3F08D211E4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:tivoli_federated_identity_manager_business_gateway:6.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1807D56B-4569-47FB-8562-0DA753DCFD89"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:tivoli_federated_identity_manager_business_gateway:6.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C58DE666-C96D-48DA-B9C2-D99055976B55"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:tivoli_federated_identity_manager_business_gateway:6.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A937255-421C-450C-AA0D-3FF28B81D565"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV23435",
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV23442",
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV23445",
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV23448",
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21612612",
      "source": "psirt@us.ibm.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.securityfocus.com/bid/55732",
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV23435",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV23442",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV23445",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV23448",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21612612",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.securityfocus.com/bid/55732",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}