PT-2022-4100 · Netapp · Storagegrid

Published 2022-08-09 · Updated 2022-08-15 · CVE-2022-23238

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions StorageGRID versions 11.6.0 through 11.6.0.2

Description The issue is related to errors in information processing, which could allow a remote unauthenticated attacker to view limited metrics information and modify alert email recipients and content. This could potentially give an attacker unauthorized access to protected information or alter the content of alerts.

Recommendations For StorageGRID versions 11.6.0 through 11.6.0.2, consider updating the Linux kernel to version 4.7.0 or later to mitigate the risk. Additionally, as a temporary workaround, restrict access to metrics information and alert configuration to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-04935

CVE-2022-23238

Affected Products

Storagegrid

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-23238 · Security Note
• https://bdu.fstec.ru/vul/2022-04935 · Security Note
• https://security.netapp.com/advisory/NTAP-20220808-0001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23238 · Vendor Advisory
• https://proxysite.cloud/?cdURL=https%3A%2F%2Fsecurity.netapp.com%2Fadvisory%2FNTAP-20220808-0001%2F# · Note