CVE-2014-3097

Description

Open redirect vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0-TIV-TFIM-IF0015, 6.2.1 before 6.2.1-TIV-TFIM-IF0007, and 6.2.2 before 6.2.2-TIV-TFIM-IF0011 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

4.3

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 0.67% Top 30%

Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com

Affected: n/a n/a

References

Link	Tags
http://www-01.ibm.com/support/docview.wss?uid=swg1IV64511	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV64349	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV64512	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21684852	patch vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV64376	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV64509	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV64324	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV64497	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV64501	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV64506	vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/94265	vdb entry
http://www-01.ibm.com/support/docview.wss?uid=swg1IV64325	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV64494	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2014-3097?: CVE-2014-3097 has been scored as a medium severity vulnerability.
How to fix CVE-2014-3097?: To fix CVE-2014-3097, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2014-3097 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2014-3097 is being actively exploited. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.