PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6046 IBM CVE debrief

CVE-2016-6046 describes a cross-site scripting flaw in IBM Tivoli Storage Manager Operations Center. The issue allows a user to embed arbitrary JavaScript in the web UI, which can alter intended application behavior and may expose credentials within a trusted session. NVD rates the issue as medium severity (CVSS 5.4).

Vendor
IBM
Product
Tivoli Storage Manager
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

IBM Tivoli Storage Manager administrators, security teams managing the Operations Center web UI, and any organization that allows lower-privileged users to interact with the affected interface.

Technical summary

The NVD record maps CVE-2016-6046 to CWE-79 (cross-site scripting) and lists affected IBM Tivoli Storage Manager versions including 6.4.1 through 6.4.2.4 and 7.1 through 7.1.7, across the Operations Center web interface. The CVSS vector (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates network reachability, low attack complexity, required privileges, and user interaction. The primary impact is integrity and limited confidentiality exposure through script execution in a trusted browser session.

Defensive priority

Medium. This is not listed as KEV in the supplied corpus, but it affects a web-facing management interface and can expose credentials or alter UI behavior if exploited.

Recommended defensive actions

  • Apply the IBM vendor patch or remediation referenced in the IBM PSIRT advisory (swg21995754).
  • Review exposure of the Tivoli Storage Manager Operations Center web UI and restrict access to trusted administrators only.
  • Reduce risk from XSS by enforcing strong session protections, least privilege, and browser/content controls where available.
  • Validate whether any affected IBM Tivoli Storage Manager versions from the NVD record are deployed, including 6.4.x and 7.1.x releases listed in the source corpus.
  • Monitor for suspicious activity in the Operations Center interface, especially unexpected script injection or account/session misuse.

Evidence notes

This debrief is based only on the supplied NVD record and referenced IBM/SecurityFocus links. The CVE record was published on 2017-02-01T20:59:01.973Z and later modified on 2026-05-13T00:24:29.033Z. The source corpus explicitly identifies CWE-79, the CVSS vector CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, and IBM PSIRT vendor advisory reference swg21995754.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6046 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6046

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6046 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6046

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.