CVE-2016-1563 — Improper Input Validation in Clustered Data Ontap

CWE-20 — Improper Input ValidationCWE-200 — Sensitive Information Exposure5 documents5 sources
Severity
6.8MEDIUMNVD
EPSS
0.1%
top 67.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Netapp Clustered Data Ontap
Timeline
PublishedApr 7
Latest updateMay 17

Description

NetApp Clustered Data ONTAP 8.3.1 does not properly verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:NExploitability: 2.2 | Impact: 4.0

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-mm85-5p67-v594: NetApp Clustered Data ONTAP 8↗2022-05-17
▶
CVEList
CVE-2016-1563: NetApp Clustered Data ONTAP 8↗2016-04-07
▶

💥Exploits & PoCs

1
Exploit-DB
Joomla! < 2.5.2 - Admin Creation↗2017-01-20
▶

💬Community

1
Bugzilla
CVE-2016-6305 openssl: SSL_peek() hang on empty record↗2016-09-21
▶
CVE-2016-1563 — Improper Input Validation | cvebase