PT-2007-5533 · Ibm · Ibm Tivoli Storage Manager (Tsm) Client

Published 2007-10-30 · Updated 2017-07-29 · CVE-2007-4348

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Tivoli Storage Manager (TSM) Client versions 5.3.5.3 and 5.4.1.2

Description A cross-site scripting (XSS) issue exists in the CAD service of the IBM Tivoli Storage Manager (TSM) Client, allowing remote attackers to inject arbitrary web script or HTML via HTTP requests to port 1581. This results in the generation of log entries in the dsmerror.log file, which can be accessed through a specific web interface.

Recommendations For version 5.3.5.3, update to a version that addresses this issue. For version 5.4.1.2, update to a version that addresses this issue. As a temporary workaround, consider restricting access to the CAD service and the dsmerror.log file to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-4348

Affected Products

Ibm Tivoli Storage Manager (Tsm) Client

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-4348 · Security Note
• http://secunia.com/secunia_research/2007-75/advisory · Vendor Advisory
• http://secunia.com/advisories/27013 · Vendor Advisory
• http://securitytracker.com/id?1018868 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38125 · Note
• http://securityfocus.com/bid/26221 · Note
• http://vupen.com/english/advisories/2007/3635 · Note