PT-2017-17677 · Netapp+1 · Oncommand Performance Manager+2

Published 2017-04-10 · Updated 2017-04-17 · CVE-2017-7345

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Performance Manager and OnCommand Unified Manager for Clustered Data ONTAP versions prior to 7.1P1

Description The issue allows remote attackers to obtain sensitive information via unspecified vectors due to the improper binding of the Java Management Extension Remote Method Invocation (JMX RMI) service to the network.

Recommendations For versions prior to 7.1P1, update to version 7.1P1 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-7345

Affected Products

Java Management Extension Remote Method Invocation

Oncommand Performance Manager

Netapp Oncommand Unified Manager For Clustered Data Ontap

References · 4

• https://kb.netapp.com/support/s/article/NTAP-20170331-0002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7345 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7345 · Vendor Advisory
• http://securityfocus.com/bid/97537 · Note