Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-2141: IBM Storage Virtualization Engine: Cross-site scripting risk for credentials theft

CVE-2025-2141 · published 1 year ago

Summary

The IBM Storage Virtualization Engine has a security weakness that allows a malicious user to inject code into the system's web interface, potentially stealing sensitive information like login credentials. This is a concern because it could allow an attacker to access internal data. To protect your system, update to the latest software version.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	3948-vef_firmware	<= 8.60.0.115 `cpe:2.3:o:ibm:3948-vef_firmware::::::::`
ibm	3948-ved_firmware	<= 8.54.2.17 <= 8.60.0.115 `cpe:2.3:o:ibm:3948-ved_firmware::::::::`
ibm	3957-ved_firmware	<= 8.54.2.17 <= 8.60.0.115 `cpe:2.3:o:ibm:3957-ved_firmware::::::::`

Original advisory text

IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.115 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

References

https://www.ibm.com/support/pages/node/7238556 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published1 Jul 2025

Updated29 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-2141 · NVD

Track software like this

Free during beta