CVEvulnerability

CVE-2012-2171

6.5 MEDIUM Published 2012-06-22 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-06-22
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-89

Description

SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to execute arbitrary SQL commands via the selectedModuleOnly parameter in a state_viewmodulelog action to the ModuleServlet URI.

Affected configurations

• ibm ds storage manager host software (<= 10.83) • ibm ds storage manager host software 10.8 • ibm ds storage manager host software 10.60.x5.14 • ibm ds4100 • ibm ds4100 1724 • ibm ds4200 1814 • ibm ds4300 1722 • ibm ds4400 1742 • ibm ds4500 1742 • ibm ds4700 1814 • ibm ds4800 1815 • ibm system storage dcs3700 storage subsystem 1818 • ibm system storage ds3200 1726 • ibm system storage ds3300 1726 • ibm system storage ds3400 1726 • ibm system storage ds3512 1746 • ibm system storage ds3524 1746 • ibm system storage ds3950 express 1814 • ibm system storage ds5020 disk controller 1814-20a • ibm system storage ds5100 storage controller 1818 • ibm system storage ds5300 storage controller 1818

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References