PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8943 IBM CVE debrief

IBM Tivoli Storage Productivity Center, and related IBM Spectrum Control versions listed by NVD, are vulnerable to cross-site scripting in the Web UI. An authenticated user with limited privileges can embed arbitrary JavaScript, which can alter UI behavior and may expose credentials within a trusted session.

Vendor
IBM
Product
Tivoli Storage Productivity Center
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

IBM storage platform administrators, security teams, and anyone operating or auditing IBM Tivoli Storage Productivity Center or Spectrum Control Web UI deployments. Pay particular attention if the interface is reachable by multiple authenticated users or used for shared administrative access.

Technical summary

NVD maps this issue to CWE-79 and rates it CVSS 3.0 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The source data identifies vulnerable IBM Spectrum Control 5.2.8 through 5.2.11 and IBM Tivoli Storage Productivity Center 5.2.0 through 5.2.7.1. The core risk is browser-side script injection into a trusted Web UI session, which can lead to limited confidentiality and integrity impact.

Defensive priority

Medium priority. This is an authenticated, user-interaction-dependent web UI XSS issue rather than a high-severity remote pre-auth flaw. Patch during normal maintenance, but accelerate remediation if the affected interface is broadly used, internet-facing, or relied on for privileged administration.

Recommended defensive actions

  • Apply the IBM PSIRT/vendor patch or update referenced for this advisory.
  • Confirm whether any affected IBM Spectrum Control or Tivoli Storage Productivity Center versions are deployed, including the NVD-listed 5.2.x releases.
  • Review Web UI input handling and any custom integrations or workflows that pass user-supplied content into the interface.
  • Limit access to the management UI to trusted administrative networks and reduce the number of users with Web UI privileges.
  • Encourage users to re-authenticate after remediation and review session-handling controls for sensitive administrative accounts.

Evidence notes

Source corpus shows CVE publication on 2017-02-01 and a later NVD modification on 2026-05-13. The vulnerability description explicitly states cross-site scripting in the Web UI with potential credentials disclosure within a trusted session. NVD assigns CWE-79 and the CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The provided references include an IBM PSIRT advisory/patched reference and a SecurityFocus entry.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8943 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8943

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8943 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8943

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.