CVE-2017-15518 Information disclosure in OnCommand API Services and NetApp Service Level Manager
NetApp OnCommand API Services and Service Level Manager log privileged database passwords, allowing attackers to read sensitive credentials from logs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-15518?
CVE-2017-15518 is a high-severity vulnerability in OnCommand API Services and NetApp Service Level Manager, published on 23 Feb 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
All versions of OnCommand API Services prior to 2.1 and NetApp Service Level Manager prior to 1.0RC4 log a privileged database user account password. All users are urged to move to a fixed version. Since the affected password is changed during every upgrade/installation no further action is required.
Weakness: CWE-200
Which versions are affected by CVE-2017-15518?
It affects 2 products.
Products include Netapp Oncommand Api Services, Netapp Service Level Manager.
How do I fix CVE-2017-15518?
No fix has been published for CVE-2017-15518 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-15518 being exploited?
There is no known exploitation of CVE-2017-15518 in the wild and no public exploit code.
Other vulnerabilities in OnCommand API Services and NetApp Service Level Manager
Sources
Also known as GHSA-26jc-2mw8-4jp3.