{"status":"success","advisory":{"_id":"683547215b16347a91c39cbc","kb_acknowledgements":null,"kb_affected_list":["OnCommand API Services"],"kb_bad_data":false,"kb_cve":["CVE-2017-8919"],"kb_exploitation":"Public","kb_fixes":[{"product":"OnCommand API Services","fixes":[{"link":"http://mysupport.netapp.com/NOW/download/software/oncommand_api/1.2P3/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null}],"kb_impact":"Exploitation of this vulnerability may lead to disclosure of sensitive information.","kb_internal_notes":[{"burt":"1084857","jira":"","product":"OnCommand API Services"}],"kb_investigating_list":[],"kb_num":"9010000","kb_ref":[],"kb_rev_history":[{"comment":"Initial Public Release and Final status","date":"20170718","version":"1.0"}],"kb_revised_list":[],"kb_scoring":{"CVE-2017-8919":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"},"kb_scoring_calc":[{"cve_id":"CVE-2017-8919","range":"HIGH","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}],"kb_status":"Final","kb_summary":"All versions of OnCommand API Services prior to 1.2P3 log the LDAP BIND password entered into the Authentication Setup Option when a local or domain user attempts to log into the OnCommand API Services REST API web page. All users are urged to move to a fixed version and then change the LDAP BIND password previously entered into the Authentication Setup Option as a precaution.","kb_title":"CVE-2017-8919 Information Disclosure Vulnerability in OnCommand API Services","kb_unaffected_list":["7-Mode Transition Tool","ATTO FibreBridge - 6500N","Brocade Fabric Operating System Firmware","Cloud Manager","Clustered Data ONTAP","Clustered Data ONTAP Antivirus Connector","E-Series SANtricity OS Controller Software 11.x","E-Series SANtricity Storage Manager","E-Series SANtricity Web Services (REST API) for Web Services Proxy","FAS/AFF BIOS","Host Utilities - SAN for Linux","Host Utilities - SAN for Windows","MetroCluster Tiebreaker for clustered Data ONTAP","NetApp Cloud Backup OST Plug-in (formerly AltaVault OST Plug-in)","NetApp HCI Compute Node (Bootstrap OS)","NetApp Manageability SDK","NetApp NFS Plug-in for VMware VAAI","NetApp SANtricity SMI-S Provider","NetApp SMI-S Provider","NetApp SolidFire, Enterprise SDS & HCI Storage Node (Element Software)","ONTAP Select Deploy administration utility","OnCommand Insight","OnCommand Workflow Automation","Open Systems SnapVault Agent","Service Processor","Single Mailbox Recovery","Snap Creator Framework","SnapCenter","SnapDrive for Unix","SnapManager for Hyper-V","SnapManager for Oracle","SnapManager for SAP","Storage Services Connector","StorageGRID (formerly StorageGRID Webscale)","System Manager 9.x"],"kb_workarounds":"\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n\r\n

1.       Modify\r\nthe Logger section "level" field value to "OFF" from the\r\ndefault value ("ALL") in the file /mnt/apis/config/apiserver/apiservice/logging-config.xml\r\nand save the changed file.

\r\n\r\n

   \r\n</Logger>
\r\n   \r\n    <Logger name="org.dozer" level="ALL"\r\nadditivity="false">
\r\n       \r\n<AppenderRef ref="othersAppender"\r\nlevel="${sys:system.log.level}"/>
\r\n   \r\n    <AppenderRef ref="syslogAppender"\r\nlevel="${sys:syslog.log.level}"/>
\r\n   \r\n</Logger>

\r\n\r\n

2.       Restart\r\nOnCommand API Services

\r\n\r\n

 

\r\n\r\n
\r\n\r\n\r\n\r\n","ntap_advisory_id":"NTAP-20170718-0001","adv_id":"ntap-20170718-0001","published_date":"2017-07-18T00:00:00","updated_date":"2017-07-18T00:00:00","inserted_date":"2025-05-27T05:01:21.558000","modified_date":null}}