CVE-2014-6168: CSRF
Published Dec 29, 2014
·Updated
Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1 before 5.1.0.15 IF0056 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Affected Software
14 affected components
IBM Security Identity Manager=5.1.0
IBM Security Identity Manager=5.1.0.3
IBM Security Identity Manager=5.1.0.4
IBM Security Identity Manager=5.1.0.5
IBM Security Identity Manager=5.1.0.6
IBM Security Identity Manager=5.1.0.7
IBM Security Identity Manager=5.1.0.8
IBM Security Identity Manager=5.1.0.9
IBM Security Identity Manager=5.1.0.10
IBM Security Identity Manager=5.1.0.11
IBM Security Identity Manager=5.1.0.12
IBM Security Identity Manager=5.1.0.13
IBM Security Identity Manager=5.1.0.14
IBM Security Identity Manager=5.1.0.15
Event History
Dec 29, 2014
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-6168?
CVE-2014-6168 is considered to be of medium severity due to its nature of enabling CSRF attacks.
2
How do I fix CVE-2014-6168?
To fix CVE-2014-6168, upgrade to IBM Security Identity Manager version 5.1.0.15 or later.
3
What types of systems are affected by CVE-2014-6168?
CVE-2014-6168 affects various versions of IBM Security Identity Manager 5.1 prior to 5.1.0.15.
4
What can attackers achieve by exploiting CVE-2014-6168?
Attackers can hijack the authentication of arbitrary users, potentially executing unwanted commands.
5
Is there a workaround for CVE-2014-6168?
While upgrading is recommended, temporarily disabling CSRF protection features may serve as a workaround until a proper fix is applied.