Login Request a demo
Low severity · published Jul 3, 2016
CVE-2016-2894
IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 through 6.3 before 6.3.2.6, 6.4 before 6.4.3.3, and 7.1 before 7.1.6 allows local users to obtain sensitive retrieved…
2.5
CVSS
0.3%
EPSS
No
On KEV
Description
IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 through 6.3 before 6.3.2.6, 6.4 before 6.4.3.3, and 7.1 before 7.1.6 allows local users to obtain sensitive retrieved data from arbitrary accounts in opportunistic circumstances by leveraging previous use of a symlink during archive and retrieve actions.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
Tivoli Storage Manager · Ibm
5.5; 5.5.0; 5.5.2; 5.5.3; 5.5.4; 5.5.4.1; +34 more · source: NVD
Affected product
TS
Tivoli Storage Manager
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-2894
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-2894
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IT13686
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21985579
www.securityfocus.com
http://www.securityfocus.com/bid/91534
www.securitytracker.com
http://www.securitytracker.com/id/1036220
More from Tivoli Storage Manager
9.8
CVE-2016-8937
The IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) default authentication protocol is vulnerable to a brute force attack due to disclosing too much information…
8.8
CVE-2016-8940
IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries
8.8
CVE-2016-6045
IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted…
7.8
CVE-2017-1378
IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) disclosed unencrypted login credentials to Vmware vCenter in the application trace output which could be…
7.8
CVE-2016-5985
The IBM Tivoli Storage Manager (IBM Spectrum Protect) AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled