PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6046 IBM CVE debrief

CVE-2016-6046 describes a cross-site scripting flaw in IBM Tivoli Storage Manager Operations Center. The issue allows a user to embed arbitrary JavaScript in the web UI, which can alter intended application behavior and may expose credentials within a trusted session. NVD rates the issue as medium severity (CVSS 5.4).

Vendor
IBM
Product
CVE-2016-6046
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

IBM Tivoli Storage Manager administrators, security teams managing the Operations Center web UI, and any organization that allows lower-privileged users to interact with the affected interface.

Technical summary

The NVD record maps CVE-2016-6046 to CWE-79 (cross-site scripting) and lists affected IBM Tivoli Storage Manager versions including 6.4.1 through 6.4.2.4 and 7.1 through 7.1.7, across the Operations Center web interface. The CVSS vector (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates network reachability, low attack complexity, required privileges, and user interaction. The primary impact is integrity and limited confidentiality exposure through script execution in a trusted browser session.

Defensive priority

Medium. This is not listed as KEV in the supplied corpus, but it affects a web-facing management interface and can expose credentials or alter UI behavior if exploited.

Recommended defensive actions

  • Apply the IBM vendor patch or remediation referenced in the IBM PSIRT advisory (swg21995754).
  • Review exposure of the Tivoli Storage Manager Operations Center web UI and restrict access to trusted administrators only.
  • Reduce risk from XSS by enforcing strong session protections, least privilege, and browser/content controls where available.
  • Validate whether any affected IBM Tivoli Storage Manager versions from the NVD record are deployed, including 6.4.x and 7.1.x releases listed in the source corpus.
  • Monitor for suspicious activity in the Operations Center interface, especially unexpected script injection or account/session misuse.

Evidence notes

This debrief is based only on the supplied NVD record and referenced IBM/SecurityFocus links. The CVE record was published on 2017-02-01T20:59:01.973Z and later modified on 2026-05-13T00:24:29.033Z. The source corpus explicitly identifies CWE-79, the CVSS vector CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, and IBM PSIRT vendor advisory reference swg21995754.

Official resources

The CVE record was published on 2017-02-01; the source corpus also shows an NVD modification on 2026-05-13. IBM’s advisory reference is included in the record, indicating vendor-led disclosure and remediation information.