PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-0202 IBM CVE debrief

CVE-2016-0202 is a low-severity information disclosure issue in IBM Cloud Orchestrator. According to the NVD description, an authenticated user could view any task in the current user’s domain through the application’s tasks backend object. The published CVSS 3.0 vector indicates low confidentiality impact with no integrity or availability impact.

Vendor
IBM
Product
Cloud Orchestrator
CVSS
LOW 3.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-08
Original CVE updated
2026-05-13
Advisory published
2017-02-08
Advisory updated
2026-05-13

Who should care

IBM Cloud Orchestrator administrators, operators, and security teams responsible for task visibility and access control in affected deployments should review this issue. It also matters to anyone with authenticated access in a multi-user IBM Cloud Orchestrator environment, since the flaw concerns cross-task visibility within a domain.

Technical summary

The vulnerability is classified by NVD as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). NVD lists affected IBM Cloud Orchestrator versions as 2.3, 2.3.0.1, 2.4, 2.4.0.1, 2.4.0.2, and 2.4.0.3. The CVSS v3.0 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, which is consistent with a local, authenticated information disclosure issue rather than code execution or privilege escalation.

Defensive priority

Low to moderate. The severity is low, but the issue affects authenticated access controls and can expose task data within a domain. Prioritize remediation if the system stores sensitive operational details in tasks or if multiple tenants/users share the environment.

Recommended defensive actions

  • Apply the IBM remediation guidance referenced by the vendor advisory in the NVD record.
  • Review task visibility and authorization settings in IBM Cloud Orchestrator to ensure authenticated users only see tasks they are meant to access.
  • Audit current deployments for affected IBM Cloud Orchestrator versions listed by NVD and plan upgrades or patches accordingly.
  • Restrict authenticated access to the minimum necessary roles and monitor for unexpected task enumeration or browsing patterns.
  • Validate that sensitive operational details are not unnecessarily stored in task records or task metadata.

Evidence notes

The supplied corpus includes the NVD record and references to an IBM support advisory and a SecurityFocus entry. The vulnerability description states that an authenticated user can view any task of the current user’s domain. NVD’s metadata classifies the weakness as CWE-200 and lists affected Cloud Orchestrator versions. No exploit code, proof-of-concept, or KEV designation is present in the supplied data.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-0202 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-0202

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-0202 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-0202

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.