description: An XML parsing vulnerability affects IBM SAML-based single sign-on (SSO) systems (IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2.) This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a different user without knowledge of the victim users password. IBM X-Force ID: 139754.
problem types: Gain Privileges
affected:
{
product: Security Access Manager
vendor: IBM
versions:
status: affected, version: 9.0.0.1
status: affected, version: 9.0.0
status: affected, version: 9.0.1.0
status: affected, version: 9.0.2.0
status: affected, version: 9.0.2.1
status: affected, version: 9.0.3
status: affected, version: 9.0.3.1
status: affected, version: 9.0.4
}
{
product: Tivoli Federated Identity Manager
vendor: IBM
versions:
status: affected, version: 6.2.1
status: affected, version: 6.2
status: affected, version: 6.2.2
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/A:L/AC:L/AV:L/C:L/I:L/PR:N/S:U/UI:N
version: 3.0
]