CVE-2016-6105
HighSummary
IBM Tivoli Key Lifecycle Manager versions 2.5 and 2.6 do not perform an authentication check for critical resources or functionalities, allowing anonymous users access to protected areas.
Risk Assessment
The lack of proper authentication checks may lead to unauthorized access to sensitive data, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade to the latest version of IBM Tivoli Key Lifecycle Manager that includes authentication fixes and to implement additional security measures.
Other vulnerabilities in IBM Tivoli Key Lifecycle Manager 2.5 and 2.6
See all- CVE-2016-6103High
IBM Tivoli Key Lifecycle Manager versions 2.5 and 2.6 is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a trusted user.
- CVE-2016-6095Critical
IBM Tivoli Key Lifecycle Manager versions 2.5 and 2.6 has inadequate account lockout settings that could allow a remote attacker to brute force account credentials.
Original NVD description (English source)
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 do not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas.