6.5

CVE-2012-2171

SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to execute arbitrary SQL commands via the selectedModuleOnly parameter in a state_viewmodulelog action to the ModuleServlet URI.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Ds Storage Manager Host Software Version 10.60.x5.14
Ibm ≫ Ds4100
Ibm ≫ Ds4100 Version 1724
Ibm ≫ Ds4200 Version 1814
Ibm ≫ Ds4300 Version 1722
Ibm ≫ Ds4400 Version 1742
Ibm ≫ Ds4500 Version 1742
Ibm ≫ Ds4700 Version 1814
Ibm ≫ Ds4800 Version 1815
Ibm ≫ System Storage Ds3200 Version 1726
Ibm ≫ System Storage Ds3300 Version 1726
Ibm ≫ System Storage Ds3400 Version 1726
Ibm ≫ System Storage Ds3512 Version 1746
Ibm ≫ System Storage Ds3524 Version 1746
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.14% 0.913
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
Vendor Advisory
http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/75236