CVE-2012-2171
Medium
Description
SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to execute arbitrary SQL commands via the selectedModuleOnly parameter in a state_viewmodulelog action to the ModuleServlet URI.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Ibm System Storage Dcs3700 Storage Subsystem
PublishedJun 22, 2012
First seenJun 22, 2012
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm system_storage_dcs3700_storage_subsystem | 1818 | — |
| ibm ds_storage_manager_host_software | v ≤ 10.83, 10.8, 10.60.x5.14 | — |
| ibm ds4100 | No range specified, 1724 | — |
| ibm ds4200 | 1814 | — |
| ibm ds4300 | 1722 | — |
| ibm ds4400 | 1742 | — |
| ibm ds4500 | 1742 | — |
| ibm ds4700 | 1814 | — |
| ibm ds4800 | 1815 | — |
| ibm system_storage_ds3200 | 1726 | — |
| ibm system_storage_ds3300 | 1726 | — |
| ibm system_storage_ds3400 | 1726 | — |
| ibm system_storage_ds3512 | 1746 | — |
| ibm system_storage_ds3524 | 1746 | — |
| ibm system_storage_ds3950_express | 1814 | — |
| ibm system_storage_ds5020_disk_controller | 1814-20a | — |
| ibm system_storage_ds5100_storage_controller | 1818 | — |
| ibm system_storage_ds5300_storage_controller | 1818 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.