CVE-2009-1334

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in the login/FilepathLogin.html component of IBM Tivoli Continuous Data Protection (CDP) for Files version 3.1.4.0. The reason parameter is not properly sanitized before being reflected back to the user, allowing injection of arbitrary HTML or JavaScript [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL containing the XSS payload in the reason parameter. The target must be tricked into clicking the crafted link. No authentication or special network position is required; the attack is performed over HTTP against the vulnerable application [1].

Impact

Successful exploitation allows the attacker to execute arbitrary web script or HTML in the context of the victim's browser session. This can lead to session hijacking, defacement, or theft of sensitive information displayed on the page [1].

Mitigation

The available references do not specify a fixed version or official patch. The vendor may have provided a fix in a later release; users should consult IBM Tivoli CDP for Files update history. Until a patched version is applied, administrators should restrict access to the login interface or implement a web application firewall rule to filter the reason parameter [1].