CVE-2012-3315

no score yetEPSS 2.6%

The Java servlets in the management console in IBM Tivoli Federated Identity Manager (TFIM) through 6.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE security constraints, and obtain sensitive information related to (1) federation metadata or (2) a web plugin configuration template, via a crafted request.

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2012-11-08
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

ibm:tivoli_federated_identity_manager
ibm:tivoli_federated_identity_manager_business_gateway

References

http://secunia.com/advisories/51163
http://www-01.ibm.com/support/docview.wss?uid=swg1IV26825
http://www-01.ibm.com/support/docview.wss?uid=swg1IV26826
http://www-01.ibm.com/support/docview.wss?uid=swg1IV26827
http://www-01.ibm.com/support/docview.wss?uid=swg21615770

Check your stack JSON