CVE-2019-5495

OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://security.netapp.com/advisory/ntap-20190509-0007/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:netapp:oncommand_unified_manager::::::linux::*
	cpe:2.3:a:netapp:oncommand_unified_manager::::::vmware_vsphere::*
	cpe:2.3:a:netapp:oncommand_unified_manager::::::windows::*

History

No history.

Information

Published : 2019-05-10 20:29

Updated : 2019-05-14 17:15

NVD link : CVE-2019-5495

Mitre link : CVE-2019-5495

CVE.ORG link : CVE-2019-5495

JSON object : View

Products Affected

netapp

oncommand_unified_manager

CWE

CWE-254

7PK - Security Features

{"id": "CVE-2019-5495", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-05-10T20:29:00.600", "references": [{"url": "https://security.netapp.com/advisory/ntap-20190509-0007/", "tags": ["Vendor Advisory"], "source": "security-alert@netapp.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-254"}]}], "descriptions": [{"lang": "en", "value": "OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors."}, {"lang": "es", "value": "OnCommand Unified Manager para VMware vSphere, Linux y Windows antes de la versi\u00f3n 9.5 se env\u00eda sin ciertos encabezados de seguridad HTTP configurados que podr\u00edan permitir a un atacante obtener informaci\u00f3n confidencial a trav\u00e9s de vectores no especificados."}], "lastModified": "2019-05-14T17:15:13.267", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "161304D1-A98E-49CE-99AB-F8203A7CDAE1", "versionEndExcluding": "9.5"}, {"criteria": "cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vmware_vsphere:*:*", "vulnerable": true, "matchCriteriaId": "6AF6C63B-491D-4D3E-9E10-5B3DB45C8B04", "versionEndExcluding": "9.5"}, {"criteria": "cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "3C53CF9C-9767-4F2A-8F4F-8AE9117E0284", "versionEndExcluding": "9.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@netapp.com"}