Medium severity · published Feb 8, 2017
CVE-2016-5918
IBM Tivoli Storage Manager HSM for Windows displays the encrypted Tivoli Storage Manager password in application trace output if the password access option is prompt and the…
4.7
CVSS
0.3%
EPSS
No
On KEV
Description
IBM Tivoli Storage Manager HSM for Windows displays the encrypted Tivoli Storage Manager password in application trace output if the password access option is prompt and the password is changed.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
Tivoli Storage Manager For Space Management · Ibm
through 7.1.4.1; 7.1.0.0; through 6.4.3.0; 6.4.0.0; through 6.3 · source: NVD
Affected product
TS
Tivoli Storage Manager For Space Management
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5918
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5918
Patch
http://www.ibm.com/support/docview.wss?uid=swg21988728
Third Party Advisory
http://www.securityfocus.com/bid/92534
More from Tivoli Storage Manager For Space Management
5.5
CVE-2018-1550
IBM Spectrum Protect 7.1 and 8.1 could allow a local user to corrupt or delete highly sensitive information that would cause a denial of service to other users
5.5
CVE-2016-5927
IBM Tivoli Storage Manager for Space Management (aka Spectrum Protect for Space Management) 6.3.x before 6.3.2.6, 6.4.x before 6.4.3.3, and 7.1.x before 7.1.6, when certain…
–
CVE-2012-5954
Unspecified vulnerability in IBM Tivoli Storage Manager for Space Management (aka TSM HSM) before 6.2.5.0 and 6.3.x before 6.3.1.0 allows remote attackers to read or modify…
–
CVE-2012-4859
Unspecified vulnerability in IBM Tivoli Storage Manager for Space Management (aka TSM HSM) before 6.2.5.0 and 6.3.x before 6.3.1.0 allows local users to read or modify file system…