CVE-2013-5429

The Risk Based Access functionality in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.2 before FP9 does not prevent reuse of One Time Password (OTP) tokens, which makes it easier for remote authenticated users to complete transactions by leveraging access to an already-used token.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
2.1 UNKNOWN
NETWORK
HIGH
AV:N/AC:H/Au:S/C:N/I:P/A:N
ibmCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 40%
VendorProductVersion
ibmtivoli_federated_identity_manager
6.2.2
ibmtivoli_federated_identity_manager
6.2.2.1
ibmtivoli_federated_identity_manager
6.2.2.2
ibmtivoli_federated_identity_manager
6.2.2.3
ibmtivoli_federated_identity_manager
6.2.2.4
ibmtivoli_federated_identity_manager
6.2.2.5
ibmtivoli_federated_identity_manager
6.2.2.6
ibmtivoli_federated_identity_manager
6.2.2.7
ibmtivoli_federated_identity_manager
6.2.2.8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www-01.ibm.com/support/docview.wss?uid=swg1IV52624
http://www-01.ibm.com/support/docview.wss?uid=swg21660509
http://www-01.ibm.com/support/docview.wss?uid=swg21660510
https://exchange.xforce.ibmcloud.com/vulnerabilities/87561
http://www-01.ibm.com/support/docview.wss?uid=swg1IV52624
http://www-01.ibm.com/support/docview.wss?uid=swg21660509
http://www-01.ibm.com/support/docview.wss?uid=swg21660510
https://exchange.xforce.ibmcloud.com/vulnerabilities/87561