CVE-2011-3138

IBM Tivoli Federated Identity Manager <6.2.0.9 - Auth Bypass

Title source: llm
STIX 2.1

Description

The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit (JDK) class, which might allow attackers to bypass LTPA token signature verification by leveraging lack of thread safety.

References (4)

Core 4
Core References
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV01318
Various Sources x_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=swg24029498
Various Sources x_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=swg24029497
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/69198

Scores

EPSS 0.0176
EPSS Percentile 75.7%

Details

Status published
Products (10)
ibm/tivoli_federated_identity_manager 6.2.0
ibm/tivoli_federated_identity_manager 6.2.0.1
ibm/tivoli_federated_identity_manager 6.2.0.2
ibm/tivoli_federated_identity_manager 6.2.0.3
ibm/tivoli_federated_identity_manager 6.2.0.8
ibm/tivoli_federated_identity_manager_business_gateway 6.2.0
ibm/tivoli_federated_identity_manager_business_gateway 6.2.0.1
ibm/tivoli_federated_identity_manager_business_gateway 6.2.0.2
ibm/tivoli_federated_identity_manager_business_gateway 6.2.0.3
ibm/tivoli_federated_identity_manager_business_gateway 6.2.0.8
Published Aug 12, 2011
Tracked Since Feb 18, 2026