PT-2020-9890 · Netapp · Oncommand System Manager

Published 2020-03-24 · Updated 2020-03-26 · CVE-2019-17276

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OnCommand System Manager versions 9.3 prior to 9.3P18 OnCommand System Manager versions 9.4 prior to 9.4P2

Description The issue is related to a cross-site scripting vulnerability. This could allow an authenticated attacker to inject arbitrary scripts into the SNMP Community Names label field.

Recommendations For OnCommand System Manager versions 9.3 prior to 9.3P18, update to version 9.3P18 or later. For OnCommand System Manager versions 9.4 prior to 9.4P2, update to version 9.4P2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-17276

Affected Products

Oncommand System Manager

References · 3

• https://osv.dev/vulnerability/CVE-2019-17276 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20200323-0001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17276 · Security Note