Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

IBM Tivoli Storage Manager Operations Center allows unauthorized actions

CVE-2016-6045 · published 9 years ago
Summary

The IBM Tivoli Storage Manager Operations Center web interface can be tricked into performing actions on behalf of a logged‑in user without their consent. This could let an attacker cause changes or run commands that the system trusts, potentially impacting data backup and storage management. Apply the vendor’s security update or restrict access to trusted users and networks to mitigate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm tivoli_storage_manager 6.4.1
6.4.1.1
6.4.2
6.4.2.1
6.4.2.2
6.4.2.3
6.4.2.4
7.1
7.1.0.1
7.1.0.2
7.1.1.1
7.1.1.2
7 more version ranges
cpe:2.3:a:ibm:tivoli_storage_manager:6.4.1:*:*:*:*:*:*:*
Original advisory text
IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the...
IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published1 Feb 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-6045 · NVD
Track software like this
Free during beta