CVE-2012-2172: XSS
First published: Fri Jun 22 2012(Updated: )
Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attackers to inject arbitrary web script or HTML via the updateRegn parameter.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM DS Storage Manager Host Software | <=10.83 | |
| IBM DS Storage Manager Host Software | =10.8 | |
| IBM DS Storage Manager Host Software | =10.60.x5.14 | |
| IBM DS4100 | ||
| IBM DS4100 | =1724 | |
| IBM DS4200 | =1814 | |
| IBM DS4300 | =1722 | |
| IBM DS4400 | =1742 | |
| IBM DS4500 | =1742 | |
| IBM DS4700 | =1814 | |
| IBM DS4800 | =1815 | |
| IBM System Storage DCS3700 Storage Subsystem | =1818 | |
| IBM System Storage DS3200 | =1726 | |
| IBM System Storage DS3300 | =1726 | |
| IBM System Storage DS3400 | =1726 | |
| IBM System Storage DS3512 | =1746 | |
| IBM System Storage DS3524 | =1746 | |
| IBM System Storage DS3950 Express | =1814 | |
| IBM System Storage DS5020 Disk Controller | =1814-20a | |
| IBM System Storage DS5100 Storage Controller | =1818 | |
| IBM System Storage DS5300 Storage Controller | =1818 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2012-2172?
CVE-2012-2172 is rated as a medium severity vulnerability due to its potential for exploitation via cross-site scripting.
How do I fix CVE-2012-2172?
To fix CVE-2012-2172, you should upgrade the affected IBM System Storage DS Storage Manager to version 10.83.xx.18 or later.
Which IBM products are affected by CVE-2012-2172?
CVE-2012-2172 affects various IBM System Storage DS devices running versions before 10.83.xx.18.
Is CVE-2012-2172 exploitable remotely?
Yes, CVE-2012-2172 can be exploited remotely by attackers through the updateRegn parameter.
What type of vulnerability is CVE-2012-2172?
CVE-2012-2172 is classified as a cross-site scripting (XSS) vulnerability.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/references
- agent/severity
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm ds storage manager host software
- version/ibm ds storage manager host software/10.83
- version/ibm ds storage manager host software/10.8
- version/ibm ds storage manager host software/10.60.x5.14
- canonical/ibm ds4100
- version/ibm ds4100/1724
- canonical/ibm ds4200
- version/ibm ds4200/1814
- canonical/ibm ds4300
- version/ibm ds4300/1722
- canonical/ibm ds4400
- version/ibm ds4400/1742
- canonical/ibm ds4500
- version/ibm ds4500/1742
- canonical/ibm ds4700
- version/ibm ds4700/1814
- canonical/ibm ds4800
- version/ibm ds4800/1815
- canonical/ibm system storage dcs3700 storage subsystem
- version/ibm system storage dcs3700 storage subsystem/1818
- canonical/ibm system storage ds3200
- version/ibm system storage ds3200/1726
- canonical/ibm system storage ds3300
- version/ibm system storage ds3300/1726
- canonical/ibm system storage ds3400
- version/ibm system storage ds3400/1726
- canonical/ibm system storage ds3512
- version/ibm system storage ds3512/1746
- canonical/ibm system storage ds3524
- version/ibm system storage ds3524/1746
- canonical/ibm system storage ds3950 express
- version/ibm system storage ds3950 express/1814
- canonical/ibm system storage ds5020 disk controller
- version/ibm system storage ds5020 disk controller/1814-20a
- canonical/ibm system storage ds5100 storage controller
- version/ibm system storage ds5100 storage controller/1818
- canonical/ibm system storage ds5300 storage controller
- version/ibm system storage ds5300 storage controller/1818