Home / Security / Advisories / NTAP-20180621-0001

NTAP-20180621-0001 — CVE-2017-7568 Sensitive Information Disclosure vulnerability in OnCommand Unified Manager for 7-Mode (core package)

Published 2018-06-21 · Updated 2018-06-21 · Status: Final · Exploitation: Not public · Severity: MEDIUM 5.3 · ONTAP affected: No — other NetApp product

Official advisory: NTAP-20180621-0001 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: OnCommand family | other NetApp product | highest CVSS: 5.3

CVEs in this advisory

CVE-2017-7568 — MEDIUM · CVSS 5.3 · site index

What the CVE records say

CVE-2017-7568 — NetApp OnCommand Unified Manager for 7-Mode (core package) versions prior to 5.2.3 may disclose sensitive LDAP account information to authenticated users when the LDAP authentication configuration is tested via the user interface.

Impact

Exploitation of this vulnerability may lead to the disclosure of LDAP credential information to authenticated users.

Affected products

OnCommand Unified Manager for 7-Mode (core package)

Official fixes

OnCommand Unified Manager for 7-Mode (core package) — vendor fix ↗
OnCommand Unified Manager for 7-Mode (core package) — vendor fix ↗

What to do

Compare your installed product and version against the affected list above and the official advisory's affected-versions table.
Apply the fixed release named in the official advisory, or the documented workaround if no fix ships yet.
Limit management-plane exposure (BMC/management interfaces, web UIs, SNMP) until patched.
Track follow-ups in the site CVE index and the security RSS feed.