CVE-2012-2172 Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attac...
MediumCVSS 4.3
EPSS 1.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attackers to inject arbitrary web script or HTML via the updateRegn parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm ds storage manager host software | <= 10.83 | No fix listed |
| ibm ds storage manager host software | = 10.8 | No fix listed |
| ibm ds storage manager host software | = 10.60.x5.14 | No fix listed |
| ibm ds4100 | All versions | No fix listed |
| ibm ds4100 | = 1724 | No fix listed |
| ibm ds4200 | = 1814 | No fix listed |
| ibm ds4300 | = 1722 | No fix listed |
| ibm ds4400 | = 1742 | No fix listed |
| ibm ds4500 | = 1742 | No fix listed |
| ibm ds4700 | = 1814 | No fix listed |
| ibm ds4800 | = 1815 | No fix listed |
| ibm system storage dcs3700 storage subsystem | = 1818 | No fix listed |
| ibm system storage ds3200 | = 1726 | No fix listed |
| ibm system storage ds3300 | = 1726 | No fix listed |
| ibm system storage ds3400 | = 1726 | No fix listed |
| ibm system storage ds3512 | = 1746 | No fix listed |
| ibm system storage ds3524 | = 1746 | No fix listed |
| ibm system storage ds3950 express | = 1814 | No fix listed |
| ibm system storage ds5020 disk controller | = 1814-20a | No fix listed |
| ibm system storage ds5100 storage controller | = 1818 | No fix listed |
| ibm system storage ds5300 storage controller | = 1818 | No fix listed |
References
- www.ibm.com vendor-advisory
- www.zeroscience.mk exploit
- ssds-multiple-mp-xss(75239) vdb-entry