CVE-2012-3315 json
The Java servlets in the management console in IBM Tivoli Federated Identity Manager (TFIM) through 6.2.2 and Tivoli Federated Identity Man…
published 2012-11-08 14 y ago modified 2026-06-16 4 mo ago also EUVD-2012-3293
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.6%
- EPSS 2.6% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
The Java servlets in the management console in IBM Tivoli Federated Identity Manager (TFIM) through 6.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE security constraints, and obtain sensitive information related to (1) federation metadata or (2) a web plugin configuration template, via a crafted request.
Exploit prediction
2.59% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
www-01.ibm.com
/support/docview.wss?uid=swg1IV26827
vendor-advisory
-
www-01.ibm.com
/support/docview.wss?uid=swg1IV26825
vendor-advisory
-
www-01.ibm.com
/support/docview.wss?uid=swg1IV26826
vendor-advisory
-
www-01.ibm.com
/support/docview.wss?uid=swg21615770
vendor-advisory
- www-01.ibm.com /support/docview.wss?uid=swg21615772
-
secunia.com
/advisories/51163
third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/77796
vdb-entry
Sources
- CVE List CVE-2012-3315
- NVD CVE-2012-3315
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.