CVE-2013-5429

IBM Tivoli Federated Identity Manager <6.2.2 - Info Disclosure

Title source: llm
STIX 2.1

Description

The Risk Based Access functionality in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.2 before FP9 does not prevent reuse of One Time Password (OTP) tokens, which makes it easier for remote authenticated users to complete transactions by leveraging access to an already-used token.

References (4)

Core 4
Core References
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21660510
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21660509
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV52624
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/87561

Scores

EPSS 0.0091
EPSS Percentile 55.4%

Details

CWE
CWE-287
Status published
Products (9)
ibm/tivoli_federated_identity_manager 6.2.2
ibm/tivoli_federated_identity_manager 6.2.2.1
ibm/tivoli_federated_identity_manager 6.2.2.2
ibm/tivoli_federated_identity_manager 6.2.2.3
ibm/tivoli_federated_identity_manager 6.2.2.4
ibm/tivoli_federated_identity_manager 6.2.2.5
ibm/tivoli_federated_identity_manager 6.2.2.6
ibm/tivoli_federated_identity_manager 6.2.2.7
ibm/tivoli_federated_identity_manager 6.2.2.8
Published Jan 21, 2014
Tracked Since Feb 18, 2026