Home / Security / Advisories / NTAP-20190509-0003

NTAP-20190509-0003 — April 2019 Eclipse Jetty Vulnerabilities in NetApp Products

Published 2019-05-09 · Updated 2021-06-08 · Status: Final · Exploitation: Public · Severity: MEDIUM 6.1 · ONTAP affected: Yes

Official advisory: NTAP-20190509-0003 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: Other NetApp products · ONTAP · OnCommand family · SnapCenter · SnapManager / Snap utilities | ONTAP-relevant | highest CVSS: 6.1

CVEs in this advisory

CVE-2019-10241 — MEDIUM · CVSS 6.1 · site index
CVE-2019-10246 — MEDIUM · CVSS 5.3 · site index
CVE-2019-10247 — MEDIUM · CVSS 5.3 · site index

What the CVE records say

CVE-2019-10241 — In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

CVE-2019-10246 — In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

CVE-2019-10247 — In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.

Impact

Successful exploitation of these vulnerabilities could lead to disclosure of sensitive information or addition or modification of data.

Affected products

Element Plug-in for vCenter Server
NetApp VASA Provider for Clustered Data ONTAP 9.7 and above
OnCommand System Manager 3.x
Snap Creator Framework
SnapCenter
SnapManager for Oracle
SnapManager for SAP
Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 9.7 and above
Virtual Storage Console for VMware vSphere 9.7 and above

Official fixes

Element Plug-in for vCenter Server — vendor fix ↗
NetApp VASA Provider for Clustered Data ONTAP 9.7 and above — vendor fix ↗
Snap Creator Framework — vendor fix ↗
SnapCenter — vendor fix ↗
SnapManager for Oracle — vendor fix ↗
SnapManager for SAP — vendor fix ↗
Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 9.7 and above — vendor fix ↗
Virtual Storage Console for VMware vSphere 9.7 and above — vendor fix ↗

References

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.