Description
IBM Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1, 6.2.0, and 6.2.1 do not properly handle signature validations based on SAML 1.0, 1.1, and 2.0, which allows remote attackers to bypass intended authentication or authorization requirements via a non-conforming SAML signature.
References (5)
Core 5
Core References
Various Sources vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV10813
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/71686
Patch, Vendor Advisory x_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=swg21575309
Patch, Vendor Advisory vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV10793
Various Sources vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV10801
Scores
EPSS
0.0125
EPSS Percentile
66.3%
Details
CWE
CWE-264
Status
published
Products (6)
ibm/tivoli_federated_identity_manager
6.1.1
ibm/tivoli_federated_identity_manager
6.2.0
ibm/tivoli_federated_identity_manager
6.2.1
ibm/tivoli_federated_identity_manager_business_gateway
6.1.1
ibm/tivoli_federated_identity_manager_business_gateway
6.2.0
ibm/tivoli_federated_identity_manager_business_gateway
6.2.1
Published
Jan 04, 2012
Tracked Since
Feb 18, 2026