SQL Injection in IBM Ds4100
CVE-2012-2171
SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to execute arbitrary SQL commands via the selectedModuleOnly parameter in a state_viewmodulelog action to the ModuleServlet URI.
Vulnerability class: SQL Injection
EPSS: 0.051 (91.5th percentile) — read the EPSS interpretation.
Affected products
- Ibm Ds4100 — versions 1724
- Ibm Ds4200 — versions 1814
- Ibm Ds4300 — versions 1722
- Ibm Ds4400 — versions 1742
- Ibm Ds4500 — versions 1742
- Ibm Ds4700 — versions 1814
- Ibm Ds4800 — versions 1815
- Ibm Ds_storage_manager_host_software — versions 10.8, 10.60.x5.14
- Ibm System_storage_dcs3700_storage_subsystem — versions 1818
- Ibm System_storage_ds3200 — versions 1726
Weakness classification (CWE)
References
- psirt@us.ibm.com (x_refsource_MISC)
- psirt@us.ibm.com (vdb-entry, x_refsource_XF)
- psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)