Security Advisory - Multiple Injection Vulnerabilities in UDS

The OceanStor UDS has some vulnerability:

Attacker injects JavaScript into patch. After the patch is loaded through the OceanStor DeviceManager, the returned content contains the injected script. After the script is parsed and executed on the OceanStor DeviceManager, information leak occurs (Vulnerability ID: HWPSIRT-2014-1235).

This Vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-2251.

Attacker injects shell scripts into patch files. After the patches are loaded by administrators, the injected shell will be executed under the root privilege (Vulnerability ID: HWPSIRT-2014-1236).

This Vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-2252.

Attacker uploads XML files injected with malicious codes through the XML interface, the system file information may be leaked through the response messages. (Vulnerability ID: HWPSIRT-2014-1237).

This Vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-2253.