CVE-2004-2558 Auth bypass in n/a

High 7.5 Published 21 Nov 2005 Updated 8 Aug 2024

Remote attackers can hijack authenticated user sessions via cookie manipulation, leading to account takeover in IBM Access Manager products.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2004-2558?

CVE-2004-2558 is a high-severity authentication bypass vulnerability in n/a, published on 21 Nov 2005. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Unspecified vulnerability in IBM Tivoli SecureWay Policy Director 3.8, Access Manager for e-business 3.9 to 5.1, Access Manager Identity Manager Solution 5.1, Configuration Manager 4.2, Configuration Manager for Automated Teller Machines 2.1.0, and IBM WebSphere Everyplace Server, Service Provider Offering for Multi-platforms 2.1.3 to 2.15 allow remote attackers to hijack sessions of authenticated users via unknown attack vectors involving certain cookies, aka "Potential Credential Impersonation Attack."

Which versions are affected by CVE-2004-2558?

It affects 6 products.

Products include Ibm Tivoli Access Manager for E-Business, Ibm Tivoli Access Manager Identity Manager Solution, Ibm Tivoli Configuration Manager, Ibm Tivoli Configuration Manager for Atm, Ibm Tivoli Secureway Policy Director, Ibm Websphere Everyplace Server.

How do I fix CVE-2004-2558?

No fix has been published for CVE-2004-2558 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2004-2558 being exploited?

There is no known exploitation of CVE-2004-2558 in the wild and no public exploit code.

Sources

Also known as GHSA-h7h5-28w5-gr84.