CVE-2013-5429: Low severity ibm tivoli federated identity manager business gateway vulnerability

Published Jan 21, 2014

Updated

The Risk Based Access functionality in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.2 before FP9 does not prevent reuse of One Time Password (OTP) tokens, which makes it easier for remote authenticated users to complete transactions by leveraging access to an already-used token.

Affected Software

9 affected components

IBM Tivoli Federated Identity Manager=6.2.2

IBM Tivoli Federated Identity Manager=6.2.2.1

IBM Tivoli Federated Identity Manager=6.2.2.2

IBM Tivoli Federated Identity Manager=6.2.2.3

IBM Tivoli Federated Identity Manager=6.2.2.4

IBM Tivoli Federated Identity Manager=6.2.2.5

IBM Tivoli Federated Identity Manager=6.2.2.6

IBM Tivoli Federated Identity Manager=6.2.2.7

IBM Tivoli Federated Identity Manager=6.2.2.8

Event History

Jan 21, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-5429?

The severity of CVE-2013-5429 is classified as medium, indicating moderate risk for exploitation.

How do I fix CVE-2013-5429?

To fix CVE-2013-5429, upgrade to IBM Tivoli Federated Identity Manager version 6.2.2 FP9 or later.

What systems are affected by CVE-2013-5429?

CVE-2013-5429 affects IBM Tivoli Federated Identity Manager versions 6.2.2 to 6.2.2.8 before FP9.

What type of vulnerability is CVE-2013-5429?

CVE-2013-5429 is a vulnerability related to the reuse of One Time Password tokens.

Can CVE-2013-5429 be exploited remotely?

Yes, CVE-2013-5429 can be exploited remotely by authenticated users due to the flawed OTP token handling.