High severity · published May 26, 2017
CVE-2017-7236
SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors
7.5
CVSS
1.8%
EPSS
No
On KEV
Description
SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OU
Oncommand Unified Manager Core Package · Netapp
5.0; 5.0.1; 5.0.2; 5.1; 5.2; 5.2.1; +1 more · source: NVD
Affected product
OU
Oncommand Unified Manager Core Package
Netapp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7236
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7236
Patch
https://kb.netapp.com/support/s/article/NTAP-20170517-0001
More from Oncommand Unified Manager Core Package
7.8
CVE-2021-3156
Sudo Heap-Based Buffer Overflow Vulnerability
9.1
CVE-2021-23926
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input
7.5
CVE-2019-17069
PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message
7.5
CVE-2017-7439
NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messages
6.1
CVE-2020-1927
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to…