mickmick.net

NetApp Products Multiple Vulnerabilities

Release Date: 13 Sep 2022

RISK: Medium Risk

TYPE: Servers - Other Servers

Multiple vulnerabilities were identified in NetApp Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, sensitive information disclosure and data manipulation on the targeted system.

---

Impact

• Denial of Service
• Information Disclosure
• Data Manipulation

---

System / Technologies affected

• Active IQ Unified Manager for Linux
• Active IQ Unified Manager for Microsoft Windows
• Active IQ Unified Manager for VMware vSphere
• Element Plug-in for vCenter Server
• Management Services for Element Software and NetApp HCI
• NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S
• NetApp HCI Baseboard Management Controller (BMC) - H410C
• NetApp HCI Compute Node (Bootstrap OS)
• NetApp Manageability SDK
• NetApp SolidFire & HCI Management Node
• NetApp SolidFire, Enterprise SDS & HCI Storage Node (Element Software)
• OnCommand Insight
• ONTAP Select Deploy administration utility
• SnapCenter

---

Solutions

• Please refer to the vendor web-site for update on patches release.
  • Software fixes will be made available through the NetApp Support website in the Software Download section.
    https://mysupport.netapp.com/site/downloads/

---

Vulnerability Identifier

• CVE-2018-1285
• CVE-2019-17498
• CVE-2022-1651
• CVE-2022-2047
• CVE-2022-2048
• CVE-2022-25647
• CVE-2022-31160

---

Source

• NetApp

---

Related Link

• https://security.netapp.com/advisory/ntap-20220901-0006/
• https://security.netapp.com/advisory/ntap-20220901-0008/
• https://security.netapp.com/advisory/ntap-20220901-0009/
• https://security.netapp.com/advisory/ntap-20220909-0001/
• https://security.netapp.com/advisory/ntap-20220909-0004/
• https://security.netapp.com/advisory/ntap-20220909-0007/