Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2012-1843

Опубликовано: 22 мар. 2012
Источник: nvd
CVSS2: 6
EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in saveRestore.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to hijack the authentication of users for requests that execute Linux commands via the fileName parameter, related to a "command-injection vulnerability."

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:quantum:scalar_i500_firmware:*:*:*:*:*:*:*:*
Версия до i7.0.2 (включая)
cpe:2.3:a:quantum:scalar_i500_firmware:i2:*:*:*:*:*:*:*
cpe:2.3:a:quantum:scalar_i500_firmware:i3:*:*:*:*:*:*:*
cpe:2.3:a:quantum:scalar_i500_firmware:i3.1:*:*:*:*:*:*:*
cpe:2.3:a:quantum:scalar_i500_firmware:i4:*:*:*:*:*:*:*
cpe:2.3:a:quantum:scalar_i500_firmware:i5:*:*:*:*:*:*:*
cpe:2.3:a:quantum:scalar_i500_firmware:i5.1:*:*:*:*:*:*:*
cpe:2.3:a:quantum:scalar_i500_firmware:i6:*:*:*:*:*:*:*
cpe:2.3:a:quantum:scalar_i500_firmware:i6.1:*:*:*:*:*:*:*
cpe:2.3:a:quantum:scalar_i500_firmware:i7:*:*:*:*:*:*:*
cpe:2.3:a:quantum:scalar_i500_firmware:i7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:quantum:scalar_i500_firmware:sp4:*:*:*:*:*:*:*
cpe:2.3:a:quantum:scalar_i500_firmware:sp4.2:*:*:*:*:*:*:*

Одно из

cpe:2.3:h:quantum:scalar_i500:5u:*:*:*:*:*:*:*
cpe:2.3:h:quantum:scalar_i500:14u:*:*:*:*:*:*:*
cpe:2.3:h:quantum:scalar_i500:23u:*:*:*:*:*:*:*
Конфигурация 2

Одновременно

cpe:2.3:a:dell:powervault_ml6000_firmware:585g.gs003:*:*:*:*:*:*:*

Одно из

cpe:2.3:h:dell:powervault_ml6000:32u:*:*:*:*:*:*:*
cpe:2.3:h:dell:powervault_ml6000:41u:*:*:*:*:*:*:*
cpe:2.3:h:dell:powervault_ml6010:5u:*:*:*:*:*:*:*
cpe:2.3:h:dell:powervault_ml6020:14u:*:*:*:*:*:*:*
cpe:2.3:h:dell:powervault_ml6030:23u:*:*:*:*:*:*:*

EPSS

Процентиль: 41%
0.00191
Низкий

6 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

github логотип

GHSA-cf9w-fq7r-pxxx

github
больше 3 лет назад

Cross-site request forgery (CSRF) vulnerability in saveRestore.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to hijack the authentication of users for requests that execute Linux commands via the fileName parameter, related to a "command-injection vulnerability."

EPSS

Процентиль: 41%
0.00191
Низкий

6 Medium

CVSS2

Дефекты

CWE-352