LiveActive security incident?Get immediate response
CVE Record

CVE-2021-29864: IBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing attacks, usin...

IBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 206089

MediumCVSS 6.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-29864 is an open redirect issue in IBM Security Identity Manager 6.0 and 6.0.2. An attacker could use a trusted-looking IBM Identity Manager URL in a phishing flow to send a user to a malicious site, potentially supporting credential theft or follow-on attacks.

Executive priority

Treat this as a moderate phishing-enablement issue, not a system takeover. Prioritize remediation for exposed identity systems because abused trust in access-management links can undermine credential and workflow security even without direct data disclosure.

Technical view

The CVE describes a network-reachable open redirect phishing weakness with low attack complexity and required user interaction. The supplied CVSS 3.0 vector is 6.8 medium, with low privileges required, changed scope, high integrity impact, and no confidentiality or availability impact recorded.

Likely exposure

Exposure appears limited to IBM Security Identity Manager 6.0 and 6.0.2 deployments. Risk is higher where the web interface is reachable by users or partners and where trusted Identity Manager links are commonly used in account or access workflows.

Exploitation context

The source bundle does not show CISA KEV listing or confirmed active exploitation. The CVSS temporal metric lists exploit maturity as unproven. The attack depends on persuading a victim to interact with a crafted link and then trust the redirected destination.

Researcher notes

Evidence is limited to the CVE description, IBM advisory reference, and X-Force ID 206089. The record does not provide CWE details in the bundle. Do not assume affected versions beyond 6.0 and 6.0.2 or claim exploitation without additional source support.

Mitigation direction

  • Inventory IBM Security Identity Manager versions and identify 6.0 or 6.0.2 systems.
  • Review IBM advisory 6616101 for official remediation or workaround guidance.
  • Prioritize externally reachable identity-management portals and high-trust login workflows.
  • Warn helpdesk and administrators about trusted-link phishing using Identity Manager URLs.
  • Monitor for unusual redirect patterns, referrers, and user reports tied to Identity Manager links.

Validation and detection

  • Confirm product and version from asset inventory or administrator console records.
  • Check whether the IBM advisory remediation has been applied to affected deployments.
  • Review web access logs for abnormal redirect destinations or phishing-related referrers.
  • Validate redirect handling defensively without publishing payloads or exploit instructions.
  • Confirm user-facing identity links point only to expected trusted destinations.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-29864 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.8 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AC:L/C:N/UI:R/A:N/AV:N/S:C/I:H/PR:L/E:U/RL:O/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.8CVSS 3.0MediumCVSS:3.0/AC:L/C:N/UI:R/A:N/AV:N/S:C/I:H/PR:L/E:U/RL:O/RC:C2.34Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

6.8Medium
CVSS 3.0 vector shape for CVE-2021-29864Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AC:L/C:N/UI:R/A:N/AV:N/S:C/I:H/PR:L/E:U/RL:O/RC:C

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
IBMSecurity Identity Manager6.0.0, 6.0.2Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.