Medium severity · published Aug 6, 2021
CVE-2021-26999
NetApp Cloud Manager versions prior to 3.9.9 log sensitive information when an Active Directory connection fails
4.3
CVSS
0.6%
EPSS
No
On KEV
Description
NetApp Cloud Manager versions prior to 3.9.9 log sensitive information when an Active Directory connection fails. The logged information is available only to authenticated users. Customers with auto-upgrade enabled should already be on a fixed version while customers using on-prem connectors with auto-upgrade disabled are advised to upgrade to a fixed version.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Cloud Manager · Netapp
before 3.9.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26999
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26999
Vendor Advisory
https://security.netapp.com/advisory/NTAP-20210805-0012
More from Cloud Manager
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
9.1
CVE-2021-26990
Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability that could allow a remote attacker to overwrite arbitrary system files
8.6
CVE-2020-25097
An issue was discovered in Squid through 4.13 and 5.x through 5.0.4
7.5
CVE-2021-27002
NetApp Cloud Manager versions prior to 3.9.10 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to retrieve sensitive data via the web proxy
7.5
CVE-2021-28651
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6