CVE-2012-2171

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-2171
SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to execute arbitrary SQL commands via the selectedModuleOnly parameter in a state_viewmodulelog action to the ModuleServlet URI.

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172 Vendor Advisory
http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/75236
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:ibm:ds_storage_manager_host_software:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:ds_storage_manager_host_software:10.8:*:*:*:*:*:*:*
cpe:2.3:a:ibm:ds_storage_manager_host_software:10.60.x5.14:*:*:*:*:*:*:*
OR cpe:2.3:h:ibm:ds4100:*:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds4100:1724:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds4200:1814:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds4300:1722:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds4400:1742:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds4500:1742:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds4700:1814:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds4800:1815:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_dcs3700_storage_subsystem:1818:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds3200:1726:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds3300:1726:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds3400:1726:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds3512:1746:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds3524:1746:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds3950_express:1814:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds5020_disk_controller:1814-20a:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds5100_storage_controller:1818:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds5300_storage_controller:1818:*:*:*:*:*:*:*
History

No history.

Information

Published : 2012-06-22 10:24

Updated : 2024-02-04 18:16

NVD link : CVE-2012-2171

Mitre link : CVE-2012-2171

CVE.ORG link : CVE-2012-2171

JSON object : View

Products Affected

ibm

  • system_storage_ds3512
  • ds4200
  • ds4100
  • ds4500
  • system_storage_ds3400
  • system_storage_ds5020_disk_controller
  • ds4700
  • ds4800
  • system_storage_dcs3700_storage_subsystem
  • system_storage_ds3524
  • system_storage_ds5300_storage_controller
  • ds_storage_manager_host_software
  • ds4400
  • system_storage_ds3200
  • system_storage_ds5100_storage_controller
  • system_storage_ds3300
  • ds4300
  • system_storage_ds3950_express
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')