PT-2017-7956 · Netapp · Netapp Snapcenter Server

Published 2017-02-07 · Updated 2017-02-24 · CVE-2016-1502

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NetApp SnapCenter Server versions 1.0 through 1.0P1

Description The issue allows remote attackers to partially bypass authentication, enabling them to list and delete backups.

Recommendations For versions 1.0 through 1.0P1, update to a version that contains a fix for this issue to prevent unauthorized access and modification of backups.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2016-1502

Affected Products

Netapp Snapcenter Server

References · 3

• https://osv.dev/vulnerability/CVE-2016-1502 · Vendor Advisory
• https://kb.netapp.com/support/s/article/authentication-bypass-vulnerability-in-snapcenter-server-1-0-1-0p1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1502 · Security Note