← Back

CVE-2012-2171

nvd nist
Published: Jun 22, 2012Modified: Apr 29, 2026

JSON object

Loading...
6.5
Vector
AV:N/AC:L/Au:S/C:P/I:P/A:P
Exploitability: 8.0 / Impact: 6.4
Source: NVD

Description

SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to execute arbitrary SQL commands via the selectedModuleOnly parameter in a state_viewmodulelog action to the ModuleServlet URI.

Affected (21)

Ibm
18 products
Ds Storage Manager Host Software
Ds4100
Ds4200
Ds4300
Ds4400
Ds4500
Ds4700
Ds4800
System Storage Dcs3700 Storage Subsystem
System Storage Ds3200
System Storage Ds3300
System Storage Ds3400
System Storage Ds3512
System Storage Ds3524
System Storage Ds3950 Express
System Storage Ds5020 Disk Controller
System Storage Ds5100 Storage Controller
System Storage Ds5300 Storage Controller
Configuration A
21 vulnerable
Vulnerable SoftwareAffected Versions
Ibm
Ds Storage Manager Host Software
Up to 10.83
Ds Storage Manager Host Software
Version 10.60.x5.14
Ds Storage Manager Host Software
Version 10.8
Ibm
Ds4100
All versions
Ds4100
Version 1724
Ds4200
Version 1814
Ds4300
Version 1722
Ds4400
Version 1742
Ds4500
Version 1742
Ds4700
Version 1814
Ds4800
Version 1815
System Storage Dcs3700 Storage Subsystem
Version 1818
System Storage Ds3200
Version 1726
System Storage Ds3300
Version 1726
System Storage Ds3400
Version 1726
System Storage Ds3512
Version 1746
System Storage Ds3524
Version 1746
System Storage Ds3950 Express
Version 1814
System Storage Ds5020 Disk Controller
Version 1814-20a
System Storage Ds5100 Storage Controller
Version 1818
System Storage Ds5300 Storage Controller
Version 1818

Related CWEs

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (6)

Source: psirt@us.ibm.com
Vendor Advisory
Source: psirt@us.ibm.com
Source: psirt@us.ibm.com
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.