CVE-2012-2172

EUVD-2012-2166
Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attackers to inject arbitrary web script or HTML via the updateRegn parameter.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
Affected Products (NVD)
VendorProductVersion
ibmds_storage_manager_host_software
𝑥
≤ 10.83
ibmds_storage_manager_host_software
10.8
ibmds_storage_manager_host_software
10.60.x5.14:x5.14
ibmds4100
*
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/75239
http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/75239