Information disclosure

2023-12-1118:15:00

PRIOn knowledge base

www.prio-n.com

smu

information disclosure

url manipulation

administrative roles

6.8 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.4%

JSON

SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or combined Server+Storage administrative roles are able to access SMU configuration backup, that would normally be barred to those specific administrative roles.

CPENameOperatorVersion
system_management_unit_firmwarelt14.8.7825.01

CPE	Name	Operator	Version
	system_management_unit_firmware	lt	14.8.7825.01

References

knowledge.hitachivantara.com/Security/System_Management_Unit_(SMU)_versions_prior_to_14.8.7825.01%2C_used_to_manage_Hitachi_Vantara_NAS_products_is_susceptible_to_unintended_information_disclosure_via_unprivileged_access_to_SMU_configuration_backup_data.