CVE-2011-3138

The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business…

published August 12, 2011

CVSS
—
EPSS
2%
Percentile
77.7
In the wild
Unconfirmed
What it is

The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit (JDK) class, which might allow attackers to bypass LTPA token signature verification by leveraging lack of thread safety.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01762 · 77.7th percentile
Published
2011-08-12T17:00Z
EPSS history
Timeline
  • 12 AUG 17:00Z
    The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business…
    cvelistv5