Unscored severity · published Jun 22, 2012
CVE-2012-2171
SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote…
–
CVSS
5.1%
EPSS
No
On KEV
Description
SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to execute arbitrary SQL commands via the selectedModuleOnly parameter in a state_viewmodulelog action to the ModuleServlet URI.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.1% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
DS Storage Manager Host Software · Ibm
through 10.83; 10.8; 10.60.x5.14 · source: NVD
DS
Ds4100 · Ibm
1724 · source: NVD
DS
Ds4200 · Ibm
1814 · source: NVD
DS
Ds4300 · Ibm
1722 · source: NVD
DS
Ds4400 · Ibm
1742 · source: NVD
DS
Ds4500 · Ibm
1742 · source: NVD
DS
Ds4700 · Ibm
1814 · source: NVD
DS
Ds4800 · Ibm
1815 · source: NVD
SS
System Storage Dcs3700 Storage Subsystem · Ibm
1818 · source: NVD
SS
System Storage Ds3200 · Ibm
1726 · source: NVD
SS
System Storage Ds3300 · Ibm
1726 · source: NVD
SS
System Storage Ds3400 · Ibm
1726 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2171
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2171
Vendor Advisory
http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
www.zeroscience.mk
http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/75236
More from DS Storage Manager Host Software
–
CVE-2012-2172
Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series…