10

CVE-2019-5490

Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled that could allow unauthorized arbitrary command execution. Any platform listed in the advisory Impact section may be affected and should be upgraded to a fixed version of Service Processor firmware IMMEDIATELY.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netapp ≫ Service Processor Version 2.8 Update -
   Netapp ≫ Clustered Data Ontap Version 9.5
Netapp ≫ Service Processor Version 3.7 Update -
   Netapp ≫ Clustered Data Ontap Version 9.5
Netapp ≫ Service Processor Version 4.5 Update -
   Netapp ≫ Clustered Data Ontap Version 9.5
Netapp ≫ Service Processor Version 5.5 Update -
   Netapp ≫ Clustered Data Ontap Version 9.5
Netapp ≫ Service Processor Version 2.8 Update -
   Netapp ≫ Clustered Data Ontap Version 9.4
Netapp ≫ Service Processor Version 3.7 Update -
   Netapp ≫ Clustered Data Ontap Version 9.4
Netapp ≫ Service Processor Version 4.5 Update -
   Netapp ≫ Clustered Data Ontap Version 9.4
Netapp ≫ Service Processor Version 5.5 Update -
   Netapp ≫ Clustered Data Ontap Version 9.4
Netapp ≫ Service Processor Version 2.8 Update -
   Netapp ≫ Clustered Data Ontap Version 9.3
Netapp ≫ Service Processor Version 3.7 Update -
   Netapp ≫ Clustered Data Ontap Version 9.3
Netapp ≫ Service Processor Version 4.5 Update -
   Netapp ≫ Clustered Data Ontap Version 9.3
Netapp ≫ Service Processor Version 5.5 Update -
   Netapp ≫ Clustered Data Ontap Version 9.3
Netapp ≫ Service Processor Version 2.5 Update -
   Netapp ≫ Clustered Data Ontap Version 9.2
Netapp ≫ Service Processor Version 3.4 Update -
   Netapp ≫ Clustered Data Ontap Version 9.2
Netapp ≫ Service Processor Version 3.4 Update patch1
   Netapp ≫ Clustered Data Ontap Version 9.2
Netapp ≫ Service Processor Version 3.4 Update patch2
   Netapp ≫ Clustered Data Ontap Version 9.2
Netapp ≫ Service Processor Version 4.2 Update -
   Netapp ≫ Clustered Data Ontap Version 9.2
Netapp ≫ Service Processor Version 4.2 Update patch1
   Netapp ≫ Clustered Data Ontap Version 9.2
Netapp ≫ Service Processor Version 4.2 Update patch2
   Netapp ≫ Clustered Data Ontap Version 9.2
Netapp ≫ Service Processor Version 5.2 Update -
   Netapp ≫ Clustered Data Ontap Version 9.2
Netapp ≫ Service Processor Version 5.2 Update patch1
   Netapp ≫ Clustered Data Ontap Version 9.2
Netapp ≫ Service Processor Version 2.4.1 Update -
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 2.4.1 Update patch1
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 3.3 Update -
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 3.3 Update patch1
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 3.3 Update patch2
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 3.3 Update patch3
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 3.3 Update patch4
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 4.1 Update -
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 4.1 Update patch1
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 4.1 Update patch2
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 4.1 Update patch3
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 4.1 Update patch4
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 4.1 Update patch5
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 4.1 Update patch6
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 5.1 Update -
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 5.1 Update patch1
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 5.1 Update patch2
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 5.1 Update patch3
   Netapp ≫ Clustered Data Ontap Version 9.1
Netapp ≫ Service Processor Version 2.4 Update -
   Netapp ≫ Clustered Data Ontap Version 9.0
Netapp ≫ Service Processor Version 3.2 Update -
   Netapp ≫ Clustered Data Ontap Version 9.0
Netapp ≫ Service Processor Version 2.3.2 Update -
   Netapp ≫ Clustered Data Ontap Version 8.3
Netapp ≫ Service Processor Version 2.3.2 Update patch1
   Netapp ≫ Clustered Data Ontap Version 8.3
Netapp ≫ Service Processor Version 2.3.2 Update patch2
   Netapp ≫ Clustered Data Ontap Version 8.3
Netapp ≫ Service Processor Version 2.3.2 Update patch3
   Netapp ≫ Clustered Data Ontap Version 8.3
Netapp ≫ Service Processor Version 3.1.2 Update -
   Netapp ≫ Clustered Data Ontap Version 8.3
Netapp ≫ Service Processor Version 3.1.2 Update patch1
   Netapp ≫ Clustered Data Ontap Version 8.3
Netapp ≫ Service Processor Version 3.1.2 Update patch2
   Netapp ≫ Clustered Data Ontap Version 8.3
Netapp ≫ Service Processor Version 2.2.5 Update -
   Netapp ≫ Clustered Data Ontap Version 8.2
Netapp ≫ Service Processor Version 3.0.4 Update -
   Netapp ≫ Clustered Data Ontap Version 8.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.49% 0.876
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-1188 Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

http://support.lenovo.com/us/en/solutions/LEN-26771
https://security.netapp.com/advisory/ntap-20190305-0001/
Vendor Advisory