VulnerabilityModified
CVE-2012-2172
Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attackers to inject arbitrary web script or HTML via the…
MEDIUM 4.3EPSS 1.63%
Does this matter?
Lower severity and a low EPSS score (1.63%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attackers to inject arbitrary web script or HTML via the updateRegn parameter.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.63% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- ibm/ds storage manager host software · ibm/ds4100 · ibm/ds4200 · ibm/ds4300 · ibm/ds4400 · ibm/ds4500 · ibm/ds4700 · ibm/ds4800 · ibm/system storage dcs3700 storage subsystem · ibm/system storage ds3200 · ibm/system storage ds3300 · ibm/system storage ds3400 · ibm/system storage ds3512 · ibm/system storage ds3524 · ibm/system storage ds3950 express · ibm/system storage ds5020 disk controller · ibm/system storage ds5100 storage controller · ibm/system storage ds5300 storage controller
- Source
- psirt@us.ibm.com
References
- http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172Vendor Advisory
- http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txtExploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75239
- http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172Vendor Advisory
- http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txtExploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75239
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.