PatchTheCVEsiteminder vulnerabilities and fixes
Recent CVEs affecting siteminder, with upgrade or downgrade steps. 6 tracked.
siteminder has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2013-10-29. Highest priority: CVE-2001-1455 (score 47/100).
- CVE-2013-5968 MEDIUM 4.3 DOWNGRADE DOWNGRADE Cross-site scripting (XSS) vulnerability in CA SiteMinder 12.0 through 12.51, and SiteMinder 6 Web Agents, all
- CVE-2011-4054 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in login.fcc in CA SiteMinder R6 SP6 before CR7 and R12 SP3 before CR
- CVE-2011-1718 MEDIUM 4.3 DOWNGRADE DOWNGRADE The Web Agents component in CA SiteMinder R6 before SP6 CR2 and R12 before SP3 CR2 does not properly handle mu
- CVE-2009-2705 MEDIUM 4.3 MITIGATE MITIGATE CA SiteMinder allows remote attackers to bypass cross-site scripting (XSS) protections for J2EE applications v
- CVE-2001-1455 HIGH 7.5 DOWNGRADE Netegrity SiteMinder 3.6 through 4.5.1 allows remote attackers to bypass filtering via URLs containing Unicode
- CVE-2000-0850 HIGH 7.5 DOWNGRADE Netegrity SiteMinder before 4.11 allows remote attackers to bypass its authentication mechanism by appending "
FAQ
How do I fix siteminder vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is siteminder being exploited right now?
None of the tracked siteminder CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which siteminder CVE should I patch first?
CVE-2001-1455 currently ranks highest (47/100): Netegrity SiteMinder 3.6 through 4.5.1 allows remote attackers to bypass filtering via URLs containing Unicode.