CVE-2019-5506 — Improper Certificate Validation in Clustered Data Ontap

CWE-295 — Improper Certificate Validation3 documents3 sources
Severity
5.9MEDIUMNVD
EPSS
0.2%
top 58.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Netapp Clustered Data Ontap
Timeline
PublishedOct 9
Latest updateMay 24

Description

Clustered Data ONTAP versions 9.0 and higher do not enforce hostname verification under certain circumstances making them susceptible to impersonation via man-in-the-middle attacks.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages2 packages

▶NVDnetapp/clustered_data_ontap9.0 — 9.6+1
▶CVEListV5netapp/clustered_data_ontap9.0 and higher

🔴Vulnerability Details

2
GHSA
GHSA-qx9f-2875-ghvf: Clustered Data ONTAP versions 9↗2022-05-24
▶
CVEList
CVE-2019-5506: Clustered Data ONTAP versions 9↗2019-10-09
▶
CVE-2019-5506 — Improper Certificate Validation | cvebase