PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5988 IBM CVE debrief

CVE-2016-5988 is an information disclosure issue in IBM Security Privileged Identity Manager Virtual Appliance. According to the NVD record, generated error messages could reveal sensitive information to an authenticated user. The issue is rated MEDIUM, with a CVSS 3.0 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating remote reachability, low attack complexity, and high confidentiality impact. NVD lists affected IBM Security Privileged Identity Manager versions 2.0.2 and 2.1, and references an IBM support advisory as well as a SecurityFocus entry. The weakness is mapped to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Vendor
IBM
Product
CVE-2016-5988
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

IBM Security Privileged Identity Manager Virtual Appliance administrators, IAM/identity governance owners, and security teams responsible for protecting authenticated-user access and reviewing application error handling.

Technical summary

The vulnerability involves sensitive data being included in generated error messages that are accessible to an authenticated user. NVD associates the issue with IBM Security Privileged Identity Manager Virtual Appliance versions 2.0.2 and 2.1, and categorizes it as CWE-200. The published CVSS 3.0 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, emphasizing confidentiality loss rather than integrity or availability impact.

Defensive priority

Medium. Prioritize if the affected IBM appliance is deployed in environments where authenticated users should not be exposed to internal details, configuration data, or other sensitive operational information through errors.

Recommended defensive actions

  • Confirm whether IBM Security Privileged Identity Manager Virtual Appliance versions 2.0.2 or 2.1 are in use.
  • Review and apply the IBM support guidance referenced by NVD for this issue (swg21996614).
  • Limit authenticated-user access to only necessary roles while remediation is pending.
  • After remediation, verify that application and appliance error messages do not disclose sensitive internal information.

Evidence notes

This debrief is based on the NVD CVE record and the IBM vendor advisory reference cited there. The source data states that generated error messages could disclose sensitive information to an authenticated user, and lists affected versions 2.0.2 and 2.1. The weakness classification is CWE-200, and the NVD CVSS 3.0 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Official resources

Publicly disclosed in the CVE/NVD record on 2017-02-01, with IBM vendor advisory referenced by NVD.