CVE-2013-5429

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-01-21 · updated 2026-06-16
Weakness: CWE-287

Description

The Risk Based Access functionality in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.2 before FP9 does not prevent reuse of One Time Password (OTP) tokens, which makes it easier for remote authenticated users to complete transactions by leveraging access to an already-used token.

Affected products

IBM Tivoli Federated Identity Manager: 6.2.2, 6.2.2.1, 6.2.2.2, 6.2.2.3, 6.2.2.4, 6.2.2.5 (+3)

References

http://www-01.ibm.com/support/docview.wss?uid=swg1IV52624
http://www-01.ibm.com/support/docview.wss?uid=swg21660509
http://www-01.ibm.com/support/docview.wss?uid=swg21660510
https://exchange.xforce.ibmcloud.com/vulnerabilities/87561
http://www-01.ibm.com/support/docview.wss?uid=swg1IV52624
http://www-01.ibm.com/support/docview.wss?uid=swg21660509
http://www-01.ibm.com/support/docview.wss?uid=swg21660510
https://exchange.xforce.ibmcloud.com/vulnerabilities/87561

Get alerted when CVE-2013-5429 or the next vulnerability affects your stack