PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6045 IBM CVE debrief

IBM Tivoli Storage Manager Operations Center contains a cross-site request forgery (CSRF) vulnerability that can let an attacker trigger unauthorized actions through a trusted user’s browser/session.

Vendor
IBM
Product
CVE-2016-6045
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

IBM Tivoli Storage Manager / Operations Center administrators, security teams, and organizations that allow users to access the Operations Center web interface.

Technical summary

NVD classifies CVE-2016-6045 as CWE-352 and assigns CVSS 3.0 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 HIGH). The vulnerability is described as CSRF in IBM Tivoli Storage Manager Operations Center, where malicious and unauthorized actions can be transmitted from a user that the website trusts. NVD lists vulnerable Tivoli Storage Manager releases including 6.4.1, 6.4.1.1, 6.4.2 through 6.4.2.4, and 7.1 through 7.1.7.

Defensive priority

High. The flaw is network-reachable, requires no privileges, and can have high confidentiality, integrity, and availability impact, though user interaction is required.

Recommended defensive actions

  • Apply the IBM fix or patch referenced in the vendor advisory linked from NVD.
  • Confirm whether any NVD-listed vulnerable Tivoli Storage Manager release is deployed in your environment.
  • Restrict access to the Operations Center interface to trusted users and networks until remediated.
  • Review CSRF protections for the Operations Center and ensure state-changing requests are protected by robust request validation.
  • Monitor administrative activity for unexpected or unauthorized actions originating from browser-based sessions.

Evidence notes

This debrief is based only on the official CVE/NVD record and the IBM vendor advisory reference linked from NVD. The NVD entry provides the CVSS vector, CWE-352 classification, and affected CPE/version list; the IBM advisory is cited by NVD as the patch/vendor reference.

Official resources

CVE-2016-6045 was published in the CVE/NVD record on 2017-02-01. The NVD entry was later modified on 2026-05-13; that later timestamp reflects record maintenance, not the original vulnerability date.