PT-2021-17225 · Netapp · Netapp Cloud Manager

Published 2021-08-06 · Updated 2021-08-13 · CVE-2021-26999

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: NetApp Cloud Manager versions prior to 3.9.9

Description: The issue concerns the logging of sensitive information when an Active Directory connection fails. This logged information is accessible only to authenticated users. There is no mention of the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

Recommendations: For versions prior to 3.9.9, upgrade to a fixed version, especially for customers using on-prem connectors with auto-upgrade disabled. Customers with auto-upgrade enabled should already be on a fixed version.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2021-26999

Affected Products

Netapp Cloud Manager

References · 4

• https://security.netapp.com/advisory/NTAP-20210805-0012 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26999 · Security Note
• https://t.me/cvenotify/18791 · Telegram Post