Lucene search

NetappCVE-2022-23238

HistoryAug 10, 2022 - 8:15 p.m.

CVE-2022-23238

2022-08-1020:15:30

netapp

web.nvd.nist.gov

cve-2022-23238

linux

storagegrid

vulnerability

remote attack

metrics

alert

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

48.1%

JSON

Linux deployments of StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less than 4.7.0 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to view limited metrics information and modify alert email recipients and content.

Affected configurations

Nvd

Node

netappstoragegridRange11.6.0–11.6.0.3

AND

canonicalubuntu_linuxMatch16.04

centoscentosMatch7.9x64

linuxlinux_kernelRange<4.7

redhatenterprise_linux_serverMatch7.9x64

VendorProductVersionCPE
netappstoragegrid*cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*
canonicalubuntu_linux16.04cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:*:*:*:*
centoscentos7.9cpe:2.3:o:centos:centos:7.9:*:*:*:*:*:x64:*
linuxlinux_kernel*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
redhatenterprise_linux_server7.9cpe:2.3:o:redhat:enterprise_linux_server:7.9:*:*:*:*:*:x64:*

Vendor	Product	Version	CPE
netapp	storagegrid	*	cpe:2.3:a:netapp:storagegrid::::::::
canonical	ubuntu_linux	16.04	cpe:2.3:o:canonical:ubuntu_linux:16.04:::::::*
centos	centos	7.9	cpe:2.3:o:centos:centos:7.9::::::x64:
linux	linux_kernel	*	cpe:2.3:o:linux:linux_kernel::::::::
redhat	enterprise_linux_server	7.9	cpe:2.3:o:redhat:enterprise_linux_server:7.9::::::x64:

CNA Affected

[
  {
    "product": "StorageGRID (formerly StorageGRID Webscale)",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "11.6.0 through 11.6.0.2"
      }
    ]
  }
]

References

security.netapp.com/advisory/NTAP-20220808-0001/

Social References

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

48.1%

JSON

Related for CVE-2022-23238