CVE-2016-8940 - CVE House
Back to Database
Status published High CVE-2016-8940

IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3,...

Vulnerability Description

IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries. As a result, an attacker is able to submit SQL queries that access database tables that are not intended for access or use by administrators. The access of these product specific database tables may allow access to passwords or other sensitive information for the product. IBM Reference #: 1998946.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-8940

Credits & Attribution

No credits recorded in the NVD database.

References

More from IBM Corporation

View All →
CVE-2019-4392
HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials...
Critical 9.8
CVE-2019-4301
BigFix Self-Service Application (SSA) is vulnerable to arbitrary code execution...
High 8.4
CVE-2017-1320
IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site...
Medium 5.4
CVE-2017-1289
IBM SDK, Java Technology Edition is vulnerable XML External Entity...
High 8.2
CVE-2017-1282
IBM Content Navigator & CMIS 2.0 and 3.0 is vulnerable...
Medium 5.4

Affected Vendor

IBM Corporation

View all reports →

Affected Software

Tivoli Storage Manager
Vulnerable Versions:
5.3.5.3, 5.4.1.2, 4.2, 4.2.1, 5.1.8, 5.2.5.1, 5.2.7, 5.2.8, 5.2.9, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.4.4.0, 5.4.2.4, 5.4.2.3, 5.4.2.2, 5.3.6.9, 5.3.6.2, 5.3.6.1, 5.3.4, 5.2.5.3, 5.2.5.2, 5.2.4, 5.3.5.1, 5.3.2.4, 6.0, 5.1.0, 5.1.1, 5.1.10, 5.1.5, 5.1.6, 5.1.7, 5.1.9, 5.2.0, 5.2.1, 4.2.2, 4.2.3, 4.2.4, 5.2.2, 5.3, 5.2 Client, 5.4 Client, 5.5.7, 5.2.3.4 Client, 5.5.1.0, 5.5.1.6, 5.4, 5.5, 6.1, 6.2, 6.3, 6.4, 7.1

Timeline

Official Publish: March 7th, 2017
Last Modified: August 6th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.