Skip to content
OpenAdvisories
Medium · 5.9 CVE-2018-1443 EUVD-2018-12022GHSA-6cj6-68x7-f44g

An XML parsing vulnerability affects IBM SAML-based single sign-on (SSO) systems (IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli …

Published Mar 8, 2018 · Updated Sep 16, 2024 · Assigned by ibm

Vendor: IBM Product: Security Access Manager Product: Tivoli Federated Identity Manager

Description

An XML parsing vulnerability affects IBM SAML-based single sign-on (SSO) systems (IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2.) This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a different user without knowledge of the victim users password. IBM X-Force ID: 139754.

Affected products

VendorProductAffectedFixed
IBM Security Access Manager 9.0.0.1, 9.0.0, 9.0.1.0, 9.0.2.0, 9.0.2.1, 9.0.3, 9.0.3.1, 9.0.4 —
IBM Tivoli Federated Identity Manager 6.2.1, 6.2, 6.2.2 —

References