CVE-2012-2171

  1. Reconshell
  2. Vulnerabilities (CVE)
  3. CVE-2012-2171
SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to execute arbitrary SQL commands via the selectedModuleOnly parameter in a state_viewmodulelog action to the ModuleServlet URI.

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/75236
Advertisement

NeevaHost hosting service
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:ibm:ds_storage_manager_host_software:10.60.x5.14:*:*:*:*:*:*:*
cpe:2.3:a:ibm:ds_storage_manager_host_software:10.8:*:*:*:*:*:*:*
cpe:2.3:a:ibm:ds_storage_manager_host_software:*:*:*:*:*:*:*:*
OR cpe:2.3:h:ibm:ds4100:*:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds4100:1724:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds4200:1814:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds3200:1726:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds3300:1726:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds5300_storage_controller:1818:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds4300:1722:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds4400:1742:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds3400:1726:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds3512:1746:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds4500:1742:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds3524:1746:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_dcs3700_storage_subsystem:1818:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds5100_storage_controller:1818:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds4700:1814:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds5020_disk_controller:1814-20a:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds4800:1815:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_storage_ds3950_express:1814:*:*:*:*:*:*:*
Information

Published : 2012-06-22 03:24

Updated : 2017-08-28 18:31

NVD link : CVE-2012-2171

Mitre link : CVE-2012-2171

JSON object : View

CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Advertisement

dedicated server usa
Products Affected

ibm

  • ds4700
  • ds4200
  • system_storage_dcs3700_storage_subsystem
  • system_storage_ds3512
  • system_storage_ds3524
  • system_storage_ds3200
  • ds_storage_manager_host_software
  • ds4100
  • ds4800
  • system_storage_ds3950_express
  • ds4400
  • ds4500
  • ds4300
  • system_storage_ds3300
  • system_storage_ds5100_storage_controller
  • system_storage_ds5300_storage_controller
  • system_storage_ds5020_disk_controller
  • system_storage_ds3400