PT-2007-5533 · Ibm · Ibm Tivoli Storage Manager (Tsm) Client

Publicado 2007-10-30 · Atualizado 2017-07-29 · CVE-2007-4348

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Tivoli Storage Manager (TSM) Client versions 5.3.5.3 and 5.4.1.2

Description A cross-site scripting (XSS) issue exists in the CAD service of the IBM Tivoli Storage Manager (TSM) Client, allowing remote attackers to inject arbitrary web script or HTML via HTTP requests to port 1581. This results in the generation of log entries in the dsmerror.log file, which can be accessed through a specific web interface.

Recommendations For version 5.3.5.3, update to a version that addresses this issue. For version 5.4.1.2, update to a version that addresses this issue. As a temporary workaround, consider restricting access to the CAD service and the dsmerror.log file to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-4348

Produtos afetados

Ibm Tivoli Storage Manager (Tsm) Client

Referências · 7

• http://securitytracker.com/id?1018868 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4348 · Nota de Segurança
• http://secunia.com/secunia_research/2007-75/advisory · Aviso do Fabricante
• http://secunia.com/advisories/27013 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38125 · Nota
• http://securityfocus.com/bid/26221 · Nota
• http://vupen.com/english/advisories/2007/3635 · Nota