Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manage…

published 2012-06-22 14 y ago modified 2026-06-16 4 mo ago also EUVD-2012-2166

cvss: 4.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits: 1; Exploit-DB

Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attackers to inject arbitrary web script or HTML via the updateRegn parameter.

Timeline

2012-06-21 First public exploit (EDB-19321)
2012-06-22 Published

Exploit prediction

1.78% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-19321 IBM System Storage DS Storage Manager Profiler - Multiple Vulnerabilities webapps, 2012-06-21
zeroscience.mk http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

zeroscience.mk /codes/ibmssdssmp_sqlixss.txt
exploit
ibm.com /connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
vendor-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/75239
vdb-entry

Sources

CVE List CVE-2012-2172
NVD CVE-2012-2172

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary