High severity · published Nov 25, 2016
CVE-2016-2988
IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 6.4.x before 6.4.3.4 and 7.1.x before 7.1.6 allows…
8.5
CVSS
1%
EPSS
No
On KEV
Description
IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 6.4.x before 6.4.3.4 and 7.1.x before 7.1.6 allows remote authenticated users to bypass a TSM credential requirement and obtain administrative access by leveraging multiple simultaneous logins.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
Tivoli Storage Manager For Virtual Environments · Ibm
6.4; 7.1 · source: NVD
Affected product
TS
Tivoli Storage Manager For Virtual Environments
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-2988
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-2988
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21988781
More from Tivoli Storage Manager For Virtual Environments
5.5
CVE-2018-1550
IBM Spectrum Protect 7.1 and 8.1 could allow a local user to corrupt or delete highly sensitive information that would cause a denial of service to other users
–
CVE-2015-1988
Cross-site scripting (XSS) vulnerability in IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before…
–
CVE-2013-6713
The Data Protection for VMware component in IBM Tivoli Storage Manager for Virtual Environments (TSMVE) 6.3 through 7.1.0.2 does not properly check authorization for backup and…