FKIE_CVE-2016-6033
Vulnerability from fkie_nvd - Published: 2017-02-15 19:59 - Updated: 2026-06-17 00:50
Severity
Summary
IBM Tivoli Storage Manager for Virtual Environments 7.1 (VMware) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 1995545.
References
| URL | Tags | ||
|---|---|---|---|
| psirt@us.ibm.com | http://www.ibm.com/support/docview.wss?uid=swg21995545 | Patch, Vendor Advisory | |
| psirt@us.ibm.com | http://www.securityfocus.com/bid/95102 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ibm.com/support/docview.wss?uid=swg21995545 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/95102 | Third Party Advisory, VDB Entry |
Impacted products
{
"affected": [
{
"affectedData": [
{
"product": "Tivoli Storage Manager for Virtual Environments",
"vendor": "IBM Corporation",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"status": "affected",
"version": "6.4"
},
{
"status": "affected",
"version": "7.1"
}
]
}
],
"source": "psirt@us.ibm.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:7.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4C7423DD-591C-4E18-A790-C92E70D939C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:7.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0D197F0D-04B0-4C11-BEF2-6E001620A814",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:7.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0CAEF92-25C5-4B76-8BEF-3F40D5CEE93B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:7.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A3283700-2A4A-44D8-86DB-C2075BE96517",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:7.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E8F1687B-A288-4211-8D3D-CE1BB21800FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:7.1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9F89FD0D-6CE9-4BBA-B975-9903A41535A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:7.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B17533F4-BFEA-4F9F-9571-3078AAA63D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:7.1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C2E9340A-E44A-4CD2-9564-206F80FB0B76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:7.1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "721B0589-73A3-4725-B721-8B59AA2D69BF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:4.1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC9C3D68-7DFB-4A0F-95A9-615467D8AF52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D3CDAFDF-0A2E-4E05-9362-7623CBDE183F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BA4D7E77-7031-4B2F-B3CB-B151D85B514C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "0B340A03-6F76-4B75-9EF7-45B01AAAB4E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "46D89760-0295-48D8-866F-57FEC1CE8CF2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:4.1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5937B517-56A6-4597-ACC2-B681F122FA13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:4.1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7C48BF04-559D-43EF-8380-9AEE80397E77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E88685DC-D870-486A-9643-F3B541D743F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:4.1.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2BA58A82-8231-44C0-9B06-3BA60E2D217C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Tivoli Storage Manager for Virtual Environments 7.1 (VMware) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 1995545."
},
{
"lang": "es",
"value": "IBM Tivoli Storage Manager for Virtual Environments 7.1 (VMware) es vulnerable CSRF lo que podr\u00eda permitir a un atacante ejecutar acciones maliciosas y no autorizadas transmitidas desde un usuario en el que la p\u00e1gina web conf\u00eda. IBM Referencia #: 1995545."
}
],
"id": "CVE-2016-6033",
"lastModified": "2026-06-17T00:50:23.360",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-02-15T19:59:00.250",
"references": [
{
"source": "psirt@us.ibm.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.ibm.com/support/docview.wss?uid=swg21995545"
},
{
"source": "psirt@us.ibm.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95102"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.ibm.com/support/docview.wss?uid=swg21995545"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95102"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…