Unscored severity · published Jun 22, 2012
CVE-2012-2172
Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attackers to inject arbitrary web script or HTML via the updateRegn parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
DS Storage Manager Host Software · Ibm
through 10.83; 10.8; 10.60.x5.14 · source: NVD
DS
Ds4100 · Ibm
1724 · source: NVD
DS
Ds4200 · Ibm
1814 · source: NVD
DS
Ds4300 · Ibm
1722 · source: NVD
DS
Ds4400 · Ibm
1742 · source: NVD
DS
Ds4500 · Ibm
1742 · source: NVD
DS
Ds4700 · Ibm
1814 · source: NVD
DS
Ds4800 · Ibm
1815 · source: NVD
SS
System Storage Dcs3700 Storage Subsystem · Ibm
1818 · source: NVD
SS
System Storage Ds3200 · Ibm
1726 · source: NVD
SS
System Storage Ds3300 · Ibm
1726 · source: NVD
SS
System Storage Ds3400 · Ibm
1726 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2172
Vendor Advisory
http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
Exploit
http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/75239
More from DS Storage Manager Host Software
–
CVE-2012-2171
SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote…