CVE-2012-3310

IBM Tivoli Federated Identity Manager Information Exposure via Log Trace Setting

Title source: llm
STIX 2.1

Description

IBM Tivoli Federated Identity Manager (TFIM) before 6.1.1.14, 6.2.0 before 6.2.0.12, and 6.2.1 before 6.2.1.4 allows context-dependent attackers to discover (1) a cleartext LDAP Bind Password, (2) keystore passwords, (3) a cleartext Basic Authentication password from a client, or (4) a cleartext user password by leveraging a logging configuration with a log trace setting of all.

References (5)

Core 5
Core References
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV26823
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV26824
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/77695
Vendor Advisory x_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=swg21615977
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV26822

Scores

EPSS 0.0085
EPSS Percentile 54.6%

Details

CWE
CWE-255
Status published
Products (15)
ibm/tivoli_federated_identity_manager 6.1.1
ibm/tivoli_federated_identity_manager 6.1.1.12
ibm/tivoli_federated_identity_manager 6.2.0
ibm/tivoli_federated_identity_manager 6.2.0.1
ibm/tivoli_federated_identity_manager 6.2.0.2
ibm/tivoli_federated_identity_manager 6.2.0.3
ibm/tivoli_federated_identity_manager 6.2.0.8
ibm/tivoli_federated_identity_manager 6.2.0.9
ibm/tivoli_federated_identity_manager 6.2.0.10
ibm/tivoli_federated_identity_manager 6.2.0.11
... and 5 more
Published Jan 17, 2013
Tracked Since Feb 18, 2026