CVE-2016-6103
HighSummary
IBM Tivoli Key Lifecycle Manager versions 2.5 and 2.6 is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a trusted user.
Risk Assessment
An attacker could exploit this vulnerability to perform unauthorized operations on behalf of users, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade to the latest version of IBM Tivoli Key Lifecycle Manager to mitigate the risk associated with this vulnerability.
Other vulnerabilities in IBM Tivoli Key Lifecycle Manager 2.5 and 2.6
See all- CVE-2016-6105High
IBM Tivoli Key Lifecycle Manager versions 2.5 and 2.6 do not perform an authentication check for critical resources or functionalities, allowing anonymous users access to protected areas.
- CVE-2016-6095Critical
IBM Tivoli Key Lifecycle Manager versions 2.5 and 2.6 has inadequate account lockout settings that could allow a remote attacker to brute force account credentials.
Original NVD description (English source)
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.