What is the CVSS score of CVE-2012-3314?

CVE-2012-3314 has a CVSS 2.0 base score of 5.8 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2012-3314?

Yes, a patch is available for CVE-2012-3314. Update the affected software to the latest version immediately.

Tivoli Federated Identity Manager CVE-2012-3314

MEDIUM

Improper Input Validation (CWE-20)

2012-10-02 psirt@us.ibm.com

Authentication Bypass IBM Tivoli Federated Identity Manager Tivoli Federated Identity Manager Business Gateway

5.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:P/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Oct 02, 2012 - 21:55 cve.org

MEDIUM 5.8

DescriptionCVE.org

IBM Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1, 6.2.0, 6.2.1, and 6.2.2 allow remote attackers to establish sessions via a crafted message that leverages (1) a signature-validation bypass for SAML messages containing unsigned elements, (2) incorrect validation of XML messages, or (3) a certificate-chain validation bypass for an XML signature element that contains the signing certificate.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-20. IBM Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1, 6.2.0, 6.2.1, and 6.2.2 allow remote attackers to establish sessions via a crafted message that leverages (1) a signature-validation bypass for SAML messages containing unsigned elements, (2) incorrect validation of XML messages, or (3) a certificate-chain validation bypass for an XML signature element that contains the signing certificate. Affected products include: Ibm Tivoli Federated Identity Manager, Ibm Tivoli Federated Identity Manager Business Gateway.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.