High severity · published Jan 29, 2020
CVE-2013-3321
NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page using the SnapMirror…
7.5
CVSS
2.2%
EPSS
No
On KEV
Description
NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page using the SnapMirror log path parameter.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Oncommand System Manager · Netapp
through 2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-3321
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-3321
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/84062
Exploit
https://www.securityfocus.com/archive/1/526552
More from Oncommand System Manager
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
6.1
CVE-2020-11023
Potential XSS vulnerability in jQuery
9.8
CVE-2019-17571
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with…
9.8
CVE-2017-7658
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths…
9.8
CVE-2017-7657
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled…