PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6033 IBM CVE debrief

CVE-2016-6033 is a cross-site request forgery (CSRF) vulnerability affecting IBM VMware-related storage management products. The NVD entry rates it High and ties it to user interaction in a network-reachable attack path, meaning a trusted authenticated user can be induced to send unauthorized actions through the web interface.

Vendor
IBM
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-15
Original CVE updated
2026-05-13
Advisory published
2017-02-15
Advisory updated
2026-05-13

Who should care

IBM administrators and security teams running Tivoli Storage Manager for Virtual Environments / Data Protection for VMware or Tivoli Storage FlashCopy Manager for VMware, especially installations exposed through web-based administrative workflows. Any environment where privileged operators use the affected console should treat this as relevant.

Technical summary

NVD describes the issue as CSRF (CWE-352) with CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The affected CPEs in the NVD record include multiple IBM Tivoli Storage Manager for Virtual Environments Data Protection for VMware versions (7.1.0 through 7.1.6.3) and Tivoli Storage FlashCopy Manager for VMware versions (4.1.0.0 through 4.1.6.0). The vendor reference in NVD points to IBM reference 1995545.

Defensive priority

High. The flaw requires user interaction, but it can trigger unauthorized actions through a trusted website context and the NVD impact rating is high across confidentiality, integrity, and availability.

Recommended defensive actions

  • Review IBM PSIRT guidance for reference 1995545 and apply the vendor-recommended fix or update path.
  • Identify whether any listed IBM VMware backup/storage management versions are deployed in your environment.
  • Restrict access to administrative web interfaces and enforce strong session protections where available.
  • Verify that users who administer the product are protected against phishing and malicious cross-site requests.
  • Monitor for unexpected administrative actions or configuration changes in the affected console.

Evidence notes

Source data identifies CVE-2016-6033 as a CSRF issue in IBM Tivoli Storage Manager for Virtual Environments 7.1 (VMware). NVD lists the weakness as CWE-352 and provides CVSS 3.0 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The NVD reference list includes IBM support docview reference 1995545 and a SecurityFocus entry (BID 95102). The supplied enrichment marks this as not in CISA KEV.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6033 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6033

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6033 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6033

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.