medium4.3Public exploit code
CVE-2012-2172
Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- IBM System Storage DS Storage Manager Profiler - Multiple Vulnerabilities2012-06-21 · webapps · windows
Impact
Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attackers to inject arbitrary web script or HTML via the updateRegn parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ibm | Ds Storage Manager Host Software | through 10.83 Versions 10.8, 10.60.x5.14 |
| Ibm | Ds4100 | All versions Version 1724 |
| Ibm | Ds4200 | Version 1814 |
| Ibm | Ds4300 | Version 1722 |
| Ibm | Ds4400 | Version 1742 |
| Ibm | Ds4500 | Version 1742 |
| Ibm | Ds4700 | Version 1814 |
| Ibm | Ds4800 | Version 1815 |
| Ibm | System Storage Dcs3700 Storage Subsystem | Version 1818 |
| Ibm | System Storage Ds3200 | Version 1726 |
| Ibm | System Storage Ds3300 | Version 1726 |
| Ibm | System Storage Ds3400 | Version 1726 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
- http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75239
- http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
- http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75239