CVE-2014-6168: CSRF
First published: Mon Dec 29 2014(Updated: )
Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1 before 5.1.0.15 IF0056 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Security Identity Manager | =5.1.0 | |
| IBM Security Identity Manager | =5.1.0.3 | |
| IBM Security Identity Manager | =5.1.0.4 | |
| IBM Security Identity Manager | =5.1.0.5 | |
| IBM Security Identity Manager | =5.1.0.6 | |
| IBM Security Identity Manager | =5.1.0.7 | |
| IBM Security Identity Manager | =5.1.0.8 | |
| IBM Security Identity Manager | =5.1.0.9 | |
| IBM Security Identity Manager | =5.1.0.10 | |
| IBM Security Identity Manager | =5.1.0.11 | |
| IBM Security Identity Manager | =5.1.0.12 | |
| IBM Security Identity Manager | =5.1.0.13 | |
| IBM Security Identity Manager | =5.1.0.14 | |
| IBM Security Identity Manager | =5.1.0.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-6168?
CVE-2014-6168 is considered to be of medium severity due to its nature of enabling CSRF attacks.
How do I fix CVE-2014-6168?
To fix CVE-2014-6168, upgrade to IBM Security Identity Manager version 5.1.0.15 or later.
What types of systems are affected by CVE-2014-6168?
CVE-2014-6168 affects various versions of IBM Security Identity Manager 5.1 prior to 5.1.0.15.
What can attackers achieve by exploiting CVE-2014-6168?
Attackers can hijack the authentication of arbitrary users, potentially executing unwanted commands.
Is there a workaround for CVE-2014-6168?
While upgrading is recommended, temporarily disabling CSRF protection features may serve as a workaround until a proper fix is applied.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- agent/source
- vendor/ibm
- canonical/ibm security identity manager
- version/ibm security identity manager/5.1.0
- version/ibm security identity manager/5.1.0.3
- version/ibm security identity manager/5.1.0.4
- version/ibm security identity manager/5.1.0.5
- version/ibm security identity manager/5.1.0.6
- version/ibm security identity manager/5.1.0.7
- version/ibm security identity manager/5.1.0.8
- version/ibm security identity manager/5.1.0.9
- version/ibm security identity manager/5.1.0.10
- version/ibm security identity manager/5.1.0.11
- version/ibm security identity manager/5.1.0.12
- version/ibm security identity manager/5.1.0.13
- version/ibm security identity manager/5.1.0.14
- version/ibm security identity manager/5.1.0.15