4.3

CVE-2012-2172

Exploit
Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attackers to inject arbitrary web script or HTML via the updateRegn parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Ds Storage Manager Host Software Version 10.60.x5.14
Ibm ≫ Ds4100
Ibm ≫ Ds4100 Version 1724
Ibm ≫ Ds4200 Version 1814
Ibm ≫ Ds4300 Version 1722
Ibm ≫ Ds4400 Version 1742
Ibm ≫ Ds4500 Version 1742
Ibm ≫ Ds4700 Version 1814
Ibm ≫ Ds4800 Version 1815
Ibm ≫ System Storage Ds3200 Version 1726
Ibm ≫ System Storage Ds3300 Version 1726
Ibm ≫ System Storage Ds3400 Version 1726
Ibm ≫ System Storage Ds3512 Version 1746
Ibm ≫ System Storage Ds3524 Version 1746
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.63% 0.731
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
Vendor Advisory
http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/75239