CVE-2016-8941: CSRF

Published Feb 1, 2017

Updated

IBM Tivoli Storage Productivity Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

Affected Software

17 affected components

IBM Spectrum Control=5.2.8

IBM Spectrum Control=5.2.9

IBM Spectrum Control=5.2.10

IBM Spectrum Control=5.2.11

IBM Tivoli Storage Productivity Center=5.2.0

IBM Tivoli Storage Productivity Center=5.2.0.0

IBM Tivoli Storage Productivity Center=5.2.1.0

IBM Tivoli Storage Productivity Center=5.2.1.1

IBM Tivoli Storage Productivity Center=5.2.2.0

IBM Tivoli Storage Productivity Center=5.2.3.0

IBM Tivoli Storage Productivity Center=5.2.4.0

IBM Tivoli Storage Productivity Center=5.2.4.1

IBM Tivoli Storage Productivity Center=5.2.5.0

IBM Tivoli Storage Productivity Center=5.2.5.1

IBM Tivoli Storage Productivity Center=5.2.6.0

IBM Tivoli Storage Productivity Center=5.2.7.0

IBM Tivoli Storage Productivity Center=5.2.7.1

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21995128

Event History

Feb 1, 2017

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionWeakness

Data Sourced

via NVD·08:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-8941?

The severity of CVE-2016-8941 is classified as medium due to its potential for cross-site request forgery.

How do I fix CVE-2016-8941?

To fix CVE-2016-8941, apply the latest security patches provided by IBM for the affected versions of IBM Tivoli Storage Productivity Center.

Which versions of IBM products are affected by CVE-2016-8941?

CVE-2016-8941 affects IBM Tivoli Storage Productivity Center versions 5.2.0 through 5.2.7.1 and IBM Spectrum Control versions 5.2.8 through 5.2.11.

Can CVE-2016-8941 lead to unauthorized actions?

Yes, CVE-2016-8941 can allow an attacker to execute malicious and unauthorized actions on behalf of a trusted user.

What types of attacks can CVE-2016-8941 facilitate?

CVE-2016-8941 can facilitate cross-site request forgery attacks that exploit user trust in the affected IBM products.