Strix
26.1K

CVE-2012-1843

UnknownEPSS 1.06%

Last modified

CVE-2012-1843 is a vulnerability of currently unknown severity. Cross-site request forgery (CSRF) vulnerability in saveRestore.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to hijack the authentication of users for requests that execute Linux commands via the fileName parameter, related to a "command-injection vulnerability.". EPSS estimates a 1.06% chance of exploitation in the next 30 days.

Description

Cross-site request forgery (CSRF) vulnerability in saveRestore.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to hijack the authentication of users for requests that execute Linux commands via the fileName parameter, related to a "command-injection vulnerability."

Metrics

EPSS Probability
1.06%

60.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
QuantumScalar I500 Firmware<= i7.0.2
QuantumScalar I500 Firmwarei2
QuantumScalar I500 Firmwarei3
QuantumScalar I500 Firmwarei3.1
QuantumScalar I500 Firmwarei4
QuantumScalar I500 Firmwarei5
QuantumScalar I500 Firmwarei5.1
QuantumScalar I500 Firmwarei6
QuantumScalar I500 Firmwarei6.1
QuantumScalar I500 Firmwarei7
QuantumScalar I500 Firmwarei7.0.1
QuantumScalar I500 Firmwaresp4
QuantumScalar I500 Firmwaresp4.2
QuantumScalar I5005u
QuantumScalar I50014u
QuantumScalar I50023u
DellPowervault Ml6000 Firmware585g.gs003
DellPowervault Ml600032u
DellPowervault Ml600041u
DellPowervault Ml60105u
DellPowervault Ml602014u
DellPowervault Ml603023u

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2012-1843?
Cross-site request forgery (CSRF) vulnerability in saveRestore.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to hijack the authentication of users for requests that execute Linux commands via the fileName parameter, related to a "command-injection vulnerability."
How severe is CVE-2012-1843?
Severity scoring for CVE-2012-1843 is pending analysis. The EPSS model estimates a 1.06% probability of exploitation in the next 30 days.
How do I fix CVE-2012-1843?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2012-1843?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST