CVE-2007-4348

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-10-30 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the CAD service in IBM Tivoli Storage Manager (TSM) Client 5.3.5.3 and 5.4.1.2 for Windows allows remote attackers to inject arbitrary web script or HTML via HTTP requests to port 1581, which generate log entries in a dsmerror.log file that is accessible through a certain web interface.

Affected products

IBM Tivoli Storage Manager Client: through 5.3.5.3; through 5.4.1.2

References

http://secunia.com/advisories/27013
http://secunia.com/secunia_research/2007-75/advisory
http://www.securityfocus.com/bid/26221
http://www.securitytracker.com/id?1018868
http://www.vupen.com/english/advisories/2007/3635
https://exchange.xforce.ibmcloud.com/vulnerabilities/38125
http://secunia.com/advisories/27013
http://secunia.com/secunia_research/2007-75/advisory
http://www.securityfocus.com/bid/26221
http://www.securitytracker.com/id?1018868
http://www.vupen.com/english/advisories/2007/3635
https://exchange.xforce.ibmcloud.com/vulnerabilities/38125

Get alerted when CVE-2007-4348 or the next vulnerability affects your stack