← Vulnerability feed

Vulnerability record · CVE-2017-1534 · published 10 January 2018

CVE-2017-1534: Ibm security access manager for web firmware open redirect vulnerability

Ibm · Security Access Manager For Web Firmware

IBM Security Access Manager Appliance 8.0.0 and 9.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 130676.

6.1 CVSS 3.0 Medium EPSS 1.0% · top 37.7% CWE-601 · Open redirect
6.1CVSS 3.0 base score, v2 5.8
1.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

IBM Security Access Manager Appliance 8.0.0 and 9.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 130676.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.ibm.com/support/docview.wss?uid=swg22008936 Vendor Advisory
http://www.securityfocus.com/bid/102509 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040169 Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/130676 VDB EntryVendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22008936 Vendor Advisory
http://www.securityfocus.com/bid/102509 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040169 Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/130676 VDB EntryVendor Advisory

Track CVE-2017-1534 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.1CVE-2016-3025Ibm security access manager vulnerabilityIBM Security Access Manager for Mobile 8.x before 8.0.1.4 IF3 and Security Access Manager 9.x before 9.0.1.0 IF5 do not properly restrict failed logi…EPSS 1.6%7.5CVE-2017-1473Ibm security access manager for web firmware inadequate encryption strength vulnerabilityIBM Security Access Manager Appliance 8.0.0 through 8.0.1.6 and 9.0.0 through 9.0.3.1 uses weaker than expected cryptographic algorithms that could a…EPSS 0.87%7.5CVE-2016-5919Ibm security access manager for web 7.0 firmware inadequate encryption strength vulnerabilityIBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decryp…EPSS 0.69%6.8CVE-2014-6077Ibm security access manager for web cross-site request forgery vulnerabilityCross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x be…EPSS 0.63%6.5CVE-2014-6080Ibm security access manager for mobile sql injection vulnerabilitySQL injection vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and …EPSS 1.0%6.1CVE-2017-1489Ibm tivoli access manager for e-business open redirect vulnerabilityIBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability. ECSSO Master Authenticatio…EPSS 1.2%6.1CVE-2016-3018Ibm security access manager cross-site scripting vulnerabilityIBM Security Access Manager for Web is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the …EPSS 0.78%5.9CVE-2017-1476Ibm security access manager information exposure vulnerabilityIBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 could allow a remote attacker to obtain sensitive infor…EPSS 2.3%

Source: NIST National Vulnerability Database (record CVE-2017-1534), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.