PT-2020-7435 · Netapp · Netapp Oncommand System Manager

Published 2020-01-29 · Updated 2020-01-31 · CVE-2013-3321

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: NetApp OnCommand System Manager versions 2.1 and earlier

Description: The issue allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page using the SnapMirror log path parameter. This can be exploited by sending requests to the diagnostic page.

Recommendations: For NetApp OnCommand System Manager versions 2.1 and earlier, consider restricting access to the diagnostic page until a fix is available. As a temporary workaround, avoid using the SnapMirror log path parameter in requests to the diagnostic page. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2013-3321

Affected Products

Netapp Oncommand System Manager

References · 4

• 🔥 https://securityfocus.com/archive/1/526552 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-3321 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/84062 · Note
• https://t.me/cvenotify/632 · Telegram Post