ByteOS Network

Vulnerability Details :

CVE-2016-6904

Assigner-netapp

Assigner Org ID-11fdca00-0482-4c88-a206-37f9c182c87d

Published At-11 Dec, 2017 | 15:00

Updated At-17 Sep, 2024 | 00:35

Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could allow an unauthenticated attacker to obtain authentication credentials.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:netapp

Assigner Org ID:11fdca00-0482-4c88-a206-37f9c182c87d

Published At:11 Dec, 2017 | 15:00

Updated At:17 Sep, 2024 | 00:35

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

NetApp, Inc.

Product

VASA Provider for Clustered Data ONTAP

Versions

Affected

Versions prior to 7.0P1

Problem Types

Type	CWE ID	Description
text	N/A	Plain text authentication

Type: text

CWE ID: N/A

Description: Plain text authentication

References

Hyperlink	Resource
https://security.netapp.com/advisory/ntap-20171208-0002/	x_refsource_CONFIRM

Hyperlink: https://security.netapp.com/advisory/ntap-20171208-0002/

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://security.netapp.com/advisory/ntap-20171208-0002/	x_refsource_CONFIRM x_transferred

Hyperlink: https://security.netapp.com/advisory/ntap-20171208-0002/

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security-alert@netapp.com

Published At:11 Dec, 2017 | 15:29

Updated At:20 Apr, 2025 | 01:37

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	8.1	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.0

Base score: 8.1

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:N/A:N

CPE Matches

NetApp, Inc.

>>vasa_provider>>Versions up to 7.0(inclusive)

cpe:2.3:a:netapp:vasa_provider:*:*:*:*:*:clustered_data_ontap:*:*

Weaknesses

CWE ID	Type	Source
CWE-255	Primary	nvd@nist.gov

CWE ID: CWE-255

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://security.netapp.com/advisory/ntap-20171208-0002/	security-alert@netapp.com	Issue Tracking Vendor Advisory
https://security.netapp.com/advisory/ntap-20171208-0002/	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking Vendor Advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20171208-0002/

Source: security-alert@netapp.com

Resource:

Issue Tracking

Vendor Advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20171208-0002/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Issue Tracking

Vendor Advisory

Similar CVEs

52Records found

CVE-2021-2007

Matching Score-8

Assigner-Oracle

View Details

Matching Score-8

Assigner-Oracle

CVSS Score-3.7||LOW

EPSS-0.50% / 64.97%

7 Day CHG~0.00%

Published-20 Jan, 2021 | 14:50

Updated-26 Sep, 2024 | 18:43

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Client accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Vendor-MariaDB Foundation Fedora Project NetApp, Inc.Oracle Corporation

Product-mariadb fedora active_iq_unified_manager oncommand_workflow_automation mysql oncommand_insight MySQL Server

CVE-2016-20012

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-5.3||MEDIUM

EPSS-25.27% / 95.98%

7 Day CHG~0.00%

Published-15 Sep, 2021 | 19:32

Updated-06 Aug, 2024 | 04:16

OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product

Vendor-n/a OpenBSD NetApp, Inc.

Product-clustered_data_ontap ontap_select_deploy_administration_utility hci_management_node openssh solidfire n/a

CVE-2016-6904

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs