SQL Injection in IBM Ds4100
CVE-2012-2171
SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to execute arbitrary SQL commands via the selectedModuleOnly parameter in a state_viewmodulelog action to the ModuleServlet URI.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.5 (Medium). Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.051 (92.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 92nd percentile — 92.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.051 · newest: 0.051 · change: 0.000
Affected products
- IBM Ds4100 — versions 1724
- IBM Ds4200 — versions 1814
- IBM Ds4300 — versions 1722
- IBM Ds4400 — versions 1742
- IBM Ds4500 — versions 1742
- IBM Ds4700 — versions 1814
- IBM Ds4800 — versions 1815
- IBM Ds Storage Manager Host Software — versions 10.8, 10.60.x5.14
- IBM System Storage Dcs3700 Subsystem — versions 1818
- IBM System Storage Ds3200 — versions 1726