Unscored severity · published Jun 8, 2014
CVE-2014-0961
Cross-site request forgery (CSRF) vulnerability in IBM Tivoli Identity Manager (ITIM) 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager (ISIM) 6.0…
–
CVSS
0.5%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in IBM Tivoli Identity Manager (ITIM) 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager (ISIM) 6.0 before 6.0.0.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Security Identity Manager · Ibm
6.0.0; 6.0.0.1 · source: NVD
TI
Tivoli Identity Manager · Ibm
5.0.0; 5.0.0.6; 5.0.0.10; 5.0.0.11; 5.0.0.12; 5.0.0.13; +14 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0961
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0961
secunia.com
http://secunia.com/advisories/59080
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21674754
www.securityfocus.com
http://www.securityfocus.com/bid/67909
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/92747
More from Security Identity Manager
9.9
CVE-2018-1969
IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment
9.8
CVE-2019-4675
IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound…
8.8
CVE-2021-29686
IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they should not have access to
8.8
CVE-2019-4561
IBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data
8.8
CVE-2018-1453
IBM Security Identity Manager Virtual Appliance 7.0 allows an authenticated attacker to upload or transfer files of dangerous types that can be automatically processed within the…