CVE-2016-8940: Infoleak
IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries. As a result, an attacker is able to submit SQL queries that access database tables that are not intended for access or use by administrators. The access of these product specific database tables may allow access to passwords or other sensitive information for the product. IBM Reference #: 1998946.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8940?
CVE-2016-8940 is classified as a medium severity vulnerability due to insufficient authority checking in SQL queries in IBM Tivoli Storage Manager.
How do I fix CVE-2016-8940?
To remediate CVE-2016-8940, users should upgrade to a patched version of IBM Tivoli Storage Manager that addresses this vulnerability.
What versions of IBM Tivoli Storage Manager are affected by CVE-2016-8940?
CVE-2016-8940 affects IBM Tivoli Storage Manager versions 6.1 through 7.1.
What are the consequences of exploiting CVE-2016-8940?
Exploitation of CVE-2016-8940 may allow an attacker to access unauthorized database tables and sensitive information.
Is there a workaround for CVE-2016-8940?
Currently, there are no known workarounds for CVE-2016-8940; the recommended solution is to apply the appropriate software update.