Auth bypass in Ibm Tivoli Storage Manager
CVE-2003-1570
The server in IBM Tivoli Storage Manager (TSM) 5.1.x, 5.2.x before 5.2.1.2, and 6.x before 6.1 does not require credentials to observe the server console in some circumstances, which allows remote authenticated administrators to monitor server operations by establishing a console mode session, related to "session exposure."
Vulnerability class: Broken Authentication
EPSS: 0.010 (59.1th percentile) — read the EPSS interpretation.
Affected products
- Ibm Tivoli_storage_manager — versions 5.1.0, 5.1.1, 5.1.5
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (vendor-advisory, Vendor Advisory, x_refsource_AIXAPAR)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)