{"status":"success","advisory":{"_id":"683547225b16347a91c39cf1","kb_acknowledgements":null,"kb_affected_list":["SnapCenter"],"kb_bad_data":false,"kb_cve":["CVE-2017-15519"],"kb_exploitation":"Not public","kb_fixes":[{"product":"SnapCenter","fixes":[],"instructions":null,"wontfix":true,"eos_link":null}],"kb_impact":"Successful exploitation of this vulnerability could lead to sensitive information disclosure or the modification of the backup configuration.","kb_internal_notes":[{"burt":"1084739","jira":"","product":"SnapCenter"}],"kb_investigating_list":[],"kb_num":"9010000","kb_ref":[],"kb_rev_history":[{"comment":"Initial Public Release, Final status","date":"20180306","version":"1.0"}],"kb_revised_list":[],"kb_scoring":{"CVE-2017-15519":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"},"kb_scoring_calc":[{"cve_id":"CVE-2017-15519","range":"HIGH","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}],"kb_status":"Final","kb_summary":"Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for NAS File Services. All users are urged to move to version 3.0.1 and perform the mitigation steps or upgrade to 4.0 following the product documentation. ","kb_title":"CVE-2017-15519 Unauthenticated Remote Access Vulnerability in SnapCenter","kb_unaffected_list":["7-Mode Transition Tool","ATTO FibreBridge","Active IQ Unified Manager (formerly OnCommand Unified Manager) for Linux 7.3 and above","Active IQ Unified Manager (formerly OnCommand Unified Manager) for VMware vSphere 9.5 and above","Active IQ Unified Manager (formerly OnCommand Unified Manager) for Windows 7.3 and above","Brocade Fabric Operating System Firmware","Brocade Network Advisor Software","Clustered Data ONTAP","Clustered Data ONTAP Antivirus Connector","Data ONTAP operating in 7-Mode","E-Series SANtricity Management Plug-ins (VMware vCenter)","E-Series SANtricity OS Controller Software 11.x","E-Series SANtricity Storage Manager","E-Series SANtricity Web Services (REST API) for Web Services Proxy","Element Plug-in for vCenter Server","FAS/AFF BIOS","Host Utilities - SAN for Linux","Host Utilities - SAN for Windows","MetroCluster Tiebreaker for clustered Data ONTAP","NetApp Cloud Backup (formerly AltaVault)","NetApp Cloud Backup OST Plug-in (formerly AltaVault OST Plug-in)","NetApp Converged Systems Advisor Agent","NetApp HCI Compute Node (Bootstrap OS)","NetApp Manageability SDK","NetApp NFS Plug-in for VMware VAAI","NetApp Plug-in for Symantec NetBackup","NetApp SANtricity SMI-S Provider","NetApp SMI-S Provider","NetApp Service Level Manager","NetApp SolidFire & HCI Storage Node (Element Software)","NetApp Storage Encryption","NetApp VASA Provider for Clustered Data ONTAP 7.2 and above","ONTAP Select Deploy administration utility","OnCommand API Services","OnCommand Cloud Manager","OnCommand Insight","OnCommand System Manager 9.x","OnCommand Unified Manager for 7-Mode (core package) ","OnCommand Workflow Automation","Open Systems SnapVault Agent","RAID Controller CTS2600 Legacy Engenio","Service Processor","Single Mailbox Recovery","Snap Creator Framework","SnapDrive for Unix","SnapDrive for Windows","SnapManager for Exchange","SnapManager for Hyper-V","SnapManager for MS SQL","SnapManager for Oracle","SnapManager for SAP","SnapManager for Sharepoint","Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 7.2 and above","Storage Services Connector","StorageGRID (formerly StorageGRID Webscale)","StorageGRID Webscale NAS Bridge","StorageGRID9 (9.x and prior)","System Setup","Virtual Storage Console for VMware vSphere 7.2 and above"],"kb_workarounds":"Beginning with SnapCenter 4.0 the Plug-in for NAS File Services has been removed. See the product documentation for additional information. \r\n\r\nTo uninstall the SnapCenter Plug-in for NAS File Services on version 3.0.1:\r\n\r\n1. Login to the SnapCenter UI console.\r\n2. In the left navigation pane select \"Settings\" then \"Managed Servers\".\r\n3. Click the \"Uninstall Plug-in\" button in the top right panel.\r\n4. Review the confirmation message that appears and then click \"Uninstall\".\r\n5. Monitor the status using the Job Monitor until all NAS file services components are removed.","ntap_advisory_id":"NTAP-20180306-0001","adv_id":"ntap-20180306-0001","published_date":"2018-03-06T00:00:00","updated_date":"2018-03-06T00:00:00","inserted_date":"2025-05-27T05:01:22.404000","modified_date":null}}