Multiple IBM System Storage products contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'updateRegn' parameter upon submission to the SoftwareRegistration.do script. This may allow a user to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Upgrade to version 10.83.xx.18 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1027194
• Exploit Database: 19321
• CVE ID: 2012-2172 (see also: NVD)
• Secunia Advisory ID: 49582
• Bugtraq ID: 54112
• ISS X-Force ID: 75239
• Related OSVDB ID: 83177
• Other Advisory URL: http://cxsecurity.com/issue/WLB-2012060257
  http://www.securelist.com/en/advisories/49582
  http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
  http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5094.php
• Packet Storm: http://packetstormsecurity.org/files/114008
• Vendor Specific Advisory URL: http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5090850&brandind=5000028
  https://www-304.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172?lang=en_us

• Gjoko Krstic - Zero Science Lab