Search

Find a vulnerability

Search criteria

    10 vulnerabilities found for snapcenter by netapp

    CVE-2025-26512 (GCVE-0-2025-26512)

    Vulnerability from cvelistv5 – Published: 2025-03-24 22:06 – Updated: 2026-02-26 19:09
    VLAI
    Title
    CVE-2025-26512 Privilege Escalation Vulnerability in SnapCenter
    Summary
    SnapCenter versions prior to 6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a SnapCenter plug-in has been installed.
    Severity
    9.9 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-03-27 03:55 UTC
    CWE
    Assigner
    netapp CNA
    References
    Impacted products
    Vendor Product Version
    NetApp SnapCenter Affected: 0 , < 6.0.1P1 (custom)
    Affected: 0 , < 6.1P1 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-03-25T00:11:33.697Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250324-0001/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26512",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-27T03:55:13.666214Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T19:09:15.329Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SnapCenter",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThan": "6.0.1P1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1P1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eSnapCenter versions prior to \n6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an \nauthenticated SnapCenter Server user to become an admin user on a remote\n system where a SnapCenter plug-in has been installed.\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "SnapCenter versions prior to \n6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an \nauthenticated SnapCenter Server user to become an admin user on a remote\n system where a SnapCenter plug-in has been installed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "CWE-266",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-24T22:06:00.720Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/NTAP-20250324-0001"
        }
      ],
      "source": {
        "advisory": "NTAP-20250324-0001",
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2025-26512 Privilege Escalation Vulnerability in SnapCenter",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2025-26512",
    "datePublished": "2025-03-24T22:06:00.720Z",
    "dateReserved": "2025-02-11T21:58:04.395Z",
    "dateUpdated": "2026-02-26T19:09:15.329Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-21993 (GCVE-0-2024-21993)

    Vulnerability from cvelistv5 – Published: 2024-07-09 21:26 – Updated: 2025-03-27 15:41
    VLAI
    Title
    Information Disclosure Vulnerability in SnapCenter
    Summary
    SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability which could allow an authenticated attacker to discover plaintext credentials.
    Severity
    5.7 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-07-10 13:20 UTC
    CWE
    • 313
    • CWE-312 - Cleartext Storage of Sensitive Information
    Assigner
    netapp CNA
    References
    Impacted products
    Vendor Product Version
    NetApp SnapCenter Affected: 0 , < 5.0p1 (patch)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21993",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-10T13:20:13.687766Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-312",
                "description": "CWE-312 Cleartext Storage of Sensitive Information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-27T15:41:35.222Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:35:34.687Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240705-0007/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SnapCenter",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThan": "5.0p1",
              "status": "affected",
              "version": "0",
              "versionType": "patch"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability\n which could allow an authenticated attacker to discover plaintext \ncredentials.\n\n"
            }
          ],
          "value": "SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability\n which could allow an authenticated attacker to discover plaintext \ncredentials."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "313",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-09T21:26:03.404Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/ntap-20240705-0007/"
        }
      ],
      "source": {
        "advisory": "NTAP-20240705-0007",
        "discovery": "UNKNOWN"
      },
      "title": "Information Disclosure Vulnerability in SnapCenter",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2024-21993",
    "datePublished": "2024-07-09T21:26:03.404Z",
    "dateReserved": "2024-01-03T19:45:25.347Z",
    "dateUpdated": "2025-03-27T15:41:35.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2024-21987 (GCVE-0-2024-21987)

    Vulnerability from cvelistv5 – Published: 2024-02-16 20:27 – Updated: 2024-08-13 20:53
    VLAI
    Title
    Improper Authorization Vulnerability in SnapCenter
    Summary
    SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging configuration settings
    Severity
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-08-13 20:53 UTC
    CWE
    Assigner
    netapp CNA
    References
    Impacted products
    Vendor Product Version
    NetApp SnapCenter Affected: 4.8 , < 5.0 (general release)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:35:34.484Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240216-0001/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21987",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-13T20:53:15.462904Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-13T20:53:25.600Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SnapCenter",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThan": "5.0",
              "status": "affected",
              "version": "4.8",
              "versionType": "general release"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SnapCenter versions 4.8 prior to 5.0 are susceptible to a \nvulnerability which could allow an authenticated SnapCenter Server user \nto modify system logging configuration settings\n\n"
            }
          ],
          "value": "SnapCenter versions 4.8 prior to 5.0 are susceptible to a \nvulnerability which could allow an authenticated SnapCenter Server user \nto modify system logging configuration settings\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T20:27:34.000Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/ntap-20240216-0001/"
        }
      ],
      "source": {
        "advisory": "NTAP-20240216-0001",
        "discovery": "UNKNOWN"
      },
      "title": "Improper Authorization Vulnerability in SnapCenter",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2024-21987",
    "datePublished": "2024-02-16T20:27:34.000Z",
    "dateReserved": "2024-01-03T19:45:25.346Z",
    "dateUpdated": "2024-08-13T20:53:25.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2023-27316 (GCVE-0-2023-27316)

    Vulnerability from cvelistv5 – Published: 2023-10-12 21:04 – Updated: 2025-02-13 16:45
    VLAI
    Title
    Privilege Escalation Vulnerability in SnapCenter
    Summary
    SnapCenter versions 4.8 through 4.9 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a SnapCenter plug-in has been installed.
    Severity
    8.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-09-18 14:59 UTC
    CWE
    • CWE-269 - Improper Privilege Management
    Assigner
    netapp CNA
    References
    Impacted products
    Vendor Product Version
    NetApp SnapCenter Affected: 4.8 , ≤ 4.9 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:09:43.103Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/NTAP-20231012-0001/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231012-0001/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-27316",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-18T14:59:09.774586Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-18T14:59:18.438Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SnapCenter",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThanOrEqual": "4.9",
              "status": "affected",
              "version": "4.8",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SnapCenter versions 4.8 through 4.9 are susceptible to a \nvulnerability which may allow an authenticated SnapCenter Server user to\n become an admin user on a remote system where a SnapCenter plug-in has \nbeen installed."
            }
          ],
          "value": "SnapCenter versions 4.8 through 4.9 are susceptible to a \nvulnerability which may allow an authenticated SnapCenter Server user to\n become an admin user on a remote system where a SnapCenter plug-in has \nbeen installed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-12T21:05:06.428Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/NTAP-20231012-0001/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231012-0001/"
        }
      ],
      "source": {
        "advisory": "NTAP-20231012-0001",
        "discovery": "UNKNOWN"
      },
      "title": "Privilege Escalation Vulnerability in SnapCenter",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2023-27316",
    "datePublished": "2023-10-12T21:04:47.473Z",
    "dateReserved": "2023-02-28T17:20:57.462Z",
    "dateUpdated": "2025-02-13T16:45:21.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2023-27313 (GCVE-0-2023-27313)

    Vulnerability from cvelistv5 – Published: 2023-10-12 18:22 – Updated: 2024-09-17 17:26
    VLAI
    Title
    Privilege Escalation Vulnerability in SnapCenter
    Summary
    SnapCenter versions 3.x and 4.x prior to 4.9 are susceptible to a vulnerability which may allow an authenticated unprivileged user to gain access as an admin user.
    Severity
    8.3 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-09-17 17:25 UTC
    CWE
    Assigner
    netapp CNA
    References
    Impacted products
    Vendor Product Version
    NetApp SnapCenter Affected: 3.0 , < 4.9 (custom)
    		Create a notification for this product.
    netapp snapcenter Affected: 3.0 , < 4.9 (custom)
        cpe:2.3:a:netapp:snapcenter:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2023-07-13 04:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:09:42.364Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230713-0002/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:netapp:snapcenter:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "snapcenter",
            "vendor": "netapp",
            "versions": [
              {
                "lessThan": "4.9",
                "status": "affected",
                "version": "3.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-27313",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-17T17:25:03.500370Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-17T17:26:14.223Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SnapCenter",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThan": "4.9",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-07-13T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SnapCenter versions 3.x and 4.x prior to 4.9 are susceptible to a \nvulnerability which may allow an authenticated unprivileged user to gain\n access as an admin user.\n\n"
            }
          ],
          "value": "SnapCenter versions 3.x and 4.x prior to 4.9 are susceptible to a \nvulnerability which may allow an authenticated unprivileged user to gain\n access as an admin user.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-12T18:22:28.435Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/ntap-20230713-0002/"
        }
      ],
      "source": {
        "advisory": "NTAP-20230713-0002",
        "discovery": "UNKNOWN"
      },
      "title": "Privilege Escalation Vulnerability in SnapCenter",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2023-27313",
    "datePublished": "2023-10-12T18:22:28.435Z",
    "dateReserved": "2023-02-28T17:20:57.461Z",
    "dateUpdated": "2024-09-17T17:26:14.223Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2017-15519 (GCVE-0-2017-15519)

    Vulnerability from cvelistv5 – Published: 2018-03-06 20:00 – Updated: 2024-09-16 18:23
    VLAI
    Summary
    Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for NAS File Services. All users are urged to move to version 3.0.1 and perform the mitigation steps or upgrade to 4.0 following the product documentation.
    Severity
    No CVSS data available.
    CWE
    • Unauthenticated Remote Access
    Assigner
    netapp CNA
    References
    Impacted products
    Vendor Product Version
    NetApp SnapCenter Affected: Versions 2.0 through 3.0.1
    		Create a notification for this product.
    Date Public
    2018-03-06 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:57:26.117Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20180306-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SnapCenter",
          "vendor": "NetApp",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 2.0 through 3.0.1"
            }
          ]
        }
      ],
      "datePublic": "2018-03-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for NAS File Services. All users are urged to move to version 3.0.1 and perform the mitigation steps or upgrade to 4.0 following the product documentation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Unauthenticated Remote Access",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-06T19:57:01.000Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20180306-0001/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-alert@netapp.com",
          "DATE_PUBLIC": "2018-03-06T00:00:00",
          "ID": "CVE-2017-15519",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SnapCenter",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Versions 2.0 through 3.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NetApp"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for NAS File Services. All users are urged to move to version 3.0.1 and perform the mitigation steps or upgrade to 4.0 following the product documentation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Unauthenticated Remote Access"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.netapp.com/advisory/ntap-20180306-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20180306-0001/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2017-15519",
    "datePublished": "2018-03-06T20:00:00.000Z",
    "dateReserved": "2017-10-17T00:00:00.000Z",
    "dateUpdated": "2024-09-16T18:23:26.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CERTFR-2024-AVI-0548

    Vulnerability from certfr_avis - Published: 2024-07-08 - Updated: 2024-07-08

    De multiples vulnérabilités ont été découvertes dans les produits NetApp. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données.

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    NetApp SnapCenter SnapCenter versions antérieures à 5.0p1
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SnapCenter versions ant\u00e9rieures \u00e0 5.0p1",
      "product": {
        "name": "SnapCenter",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-21993",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21993"
    }
  ],
  "initial_release_date": "2024-07-08T00:00:00",
  "last_revision_date": "2024-07-08T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0548",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits NetApp. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits NetApp",
  "vendor_advisories": [
    {
      "published_at": "2024-07-06",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp ntap-20240705-0007",
      "url": "https://security.netapp.com/advisory/ntap-20240705-0007/"
    }
  ]
}

    CERTFR-2024-AVI-0142

    Vulnerability from certfr_avis - Published: 2024-02-16 - Updated: 2024-02-16

    Une vulnérabilité a été découverte dans NetApp SnapCenter. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    NetApp SnapCenter SnapCenter versions antérieures à 5.0
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SnapCenter versions ant\u00e9rieures \u00e0 5.0",
      "product": {
        "name": "SnapCenter",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-21987",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21987"
    }
  ],
  "initial_release_date": "2024-02-16T00:00:00",
  "last_revision_date": "2024-02-16T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0142",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-02-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans NetApp SnapCenter. Elle permet \u00e0\nun attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es\net une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans NetApp SnapCenter",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20240216-0001 du 16 f\u00e9vrier 2024",
      "url": "https://security.netapp.com/advisory/ntap-20240216-0001/"
    }
  ]
}

    CERTFR-2023-AVI-0555

    Vulnerability from certfr_avis - Published: 2023-07-18 - Updated: 2023-07-18

    De multiples vulnérabilités ont été découvertes dans NetApp SnapCenter. Elles permettent à un attaquant de provoquer une élévation de privilèges.

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    NetApp SnapCenter SnapCenter versions 3.x et 4.x antérieures à 4.9
    NetApp SnapCenter greffon SnapCenter pour VMware vSphere versions 4.6 antérieures à 4.9
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SnapCenter versions 3.x et 4.x ant\u00e9rieures \u00e0 4.9",
      "product": {
        "name": "SnapCenter",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "greffon SnapCenter pour VMware vSphere versions 4.6 ant\u00e9rieures \u00e0 4.9",
      "product": {
        "name": "SnapCenter",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-27312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27312"
    },
    {
      "name": "CVE-2023-27313",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27313"
    }
  ],
  "initial_release_date": "2023-07-18T00:00:00",
  "last_revision_date": "2023-07-18T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0555",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-07-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans NetApp SnapCenter.\nElles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de\nprivil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans NetApp SnapCenter",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp ntap-20230713-0001 du 13 juillet 2023",
      "url": "https://security.netapp.com/advisory/ntap-20230713-0001/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp ntap-20230713-0002 du 13 juillet 2023",
      "url": "https://security.netapp.com/advisory/ntap-20230713-0002/"
    }
  ]
}

    CERTFR-2022-AVI-190

    Vulnerability from certfr_avis - Published: 2022-02-28 - Updated: 2022-02-28

    Une vulnérabilité a été découverte dans NetApp SnapCenter. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    NetApp SnapCenter SnapCenter versions antérieures à 4.5
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SnapCenter versions ant\u00e9rieures \u00e0 4.5",
      "product": {
        "name": "SnapCenter",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-23234",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23234"
    }
  ],
  "initial_release_date": "2022-02-28T00:00:00",
  "last_revision_date": "2022-02-28T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-190",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-02-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans NetApp SnapCenter. Elle permet \u00e0\nun attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans NetApp SnapCenter",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp ntap-20220228-0001 du 28 f\u00e9vrier 2022",
      "url": "https://security.netapp.com/advisory/ntap-20220228-0001/"
    }
  ]
}