IBM Security Bulletin:IBM Security Key Lifecycle Manager is vulnerable to Spoofing through URL Redirection (CVE-2017-1668)

IBM Security Key Lifecycle Manager could allow a remote attacker to conduct phishing attacks, using an open redirect attack.

CVE(s): CVE-2017-1668

Affected product(s) and affected version(s):

IBM Security Key Lifecycle Manager: v2.5 – 2.5.0.8

IBM Security Key Lifecycle Manager v2.6 – 2.6.0.3

IBM Security Key Lifecycle Manager: v2.7 – 2.7.0.2

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2lY77de
X-Force Database: http://ift.tt/2CISfKa

The post IBM Security Bulletin:IBM Security Key Lifecycle Manager is vulnerable to Spoofing through URL Redirection (CVE-2017-1668) appeared first on IBM PSIRT Blog.

from IBM Product Security Incident Response Team http://ift.tt/2lY7apq