PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6103 IBM CVE debrief

CVE-2016-6103 is a cross-site request forgery (CSRF) vulnerability in IBM Tivoli Key Lifecycle Manager 2.5 and 2.6. The issue could let an attacker cause a trusted user’s browser session to submit unauthorized actions to the application. NVD rates the issue as high severity, with network access and user interaction required.

Vendor
IBM
Product
CVE-2016-6103
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-02
Original CVE updated
2026-05-13
Advisory published
2017-02-02
Advisory updated
2026-05-13

Who should care

IBM Security/Tivoli Key Lifecycle Manager administrators, teams that manage encryption key lifecycle services, and security teams responsible for web-admin applications with privileged browser sessions.

Technical summary

NVD maps this issue to CWE-352 and lists the CVSS v3.0 vector as CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. That indicates a network-reachable issue that depends on user interaction, with potential high impact to confidentiality, integrity, and availability if a trusted user is induced to perform an unauthorized state-changing request. The affected CPEs in NVD include IBM Security Key Lifecycle Manager 2.5.x and 2.6.x entries, and the record references IBM’s vendor advisory for remediation guidance.

Defensive priority

High for environments running the affected IBM Key Lifecycle Manager versions, because the flaw can enable unauthorized administrative actions when a user is tricked into interacting with the application.

Recommended defensive actions

  • Apply IBM’s vendor patch or follow the remediation guidance in the IBM advisory linked from NVD.
  • Verify whether any deployed IBM Security Key Lifecycle Manager instances match the affected 2.5.x or 2.6.x CPE versions listed in NVD.
  • Review administrative workflows for CSRF protections and ensure privileged actions require strong request validation.
  • Limit exposure of the management interface to trusted networks and authenticated administrators only.
  • Monitor for unexpected state changes or administrative actions that could indicate misuse of a trusted session.

Evidence notes

This debrief is based on the NVD record for CVE-2016-6103, which identifies IBM Tivoli Key Lifecycle Manager as affected and classifies the weakness as CWE-352. The NVD references include IBM’s support advisory (swg21997949) and a SecurityFocus entry (BID 95950). The CVSS vector supplied by NVD is CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Published date used here is 2017-02-02, per the supplied CVE timeline.

Official resources

CVE published 2017-02-02. This summary uses the supplied CVE publish date and the NVD record’s current metadata; it does not infer any later disclosure or remediation dates beyond the provided sources.