CVE-2014-3051

IBM Tivoli Composite Application Manager for Transactions 7.1-7.2 - Man-in-the-Middle via Unverified X.509 Certificates

Title source: llm
STIX 2.1

Description

The Internet Service Monitor (ISM) agent in IBM Tivoli Composite Application Manager (ITCAM) for Transactions 7.1 and 7.2 before 7.2.0.3 IF28, 7.3 before 7.3.0.1 IF30, and 7.4 before 7.4.0.0 IF18 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain credential information via a crafted certificate.

References (3)

Core 3
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21682290
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59756
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/93444

Scores

EPSS 0.0059
EPSS Percentile 44.8%

Details

CWE
CWE-310
Status published
Products (9)
ibm/tivoli_composite_application_manager_for_transactions 7.1.0.0
ibm/tivoli_composite_application_manager_for_transactions 7.1.0.1
ibm/tivoli_composite_application_manager_for_transactions 7.1.0.2
ibm/tivoli_composite_application_manager_for_transactions 7.1.0.3
ibm/tivoli_composite_application_manager_for_transactions 7.1.0.4
ibm/tivoli_composite_application_manager_for_transactions 7.2.0.0
ibm/tivoli_composite_application_manager_for_transactions 7.2.0.1
ibm/tivoli_composite_application_manager_for_transactions 7.2.0.2
ibm/tivoli_composite_application_manager_for_transactions 7.3.0.0
Published Oct 29, 2014
Tracked Since Feb 18, 2026