Medium severity · published Jul 17, 2017
CVE-2017-7947
NetApp Clustered Data ONTAP before 8.3.2P11, 9.0 before P4, and 9.1 before P5 allow attackers to obtain sensitive password information by leveraging logging of passwords entered…
6.5
CVSS
1.3%
EPSS
No
On KEV
Description
NetApp Clustered Data ONTAP before 8.3.2P11, 9.0 before P4, and 9.1 before P5 allow attackers to obtain sensitive password information by leveraging logging of passwords entered non-interactively on the command line.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CD
Clustered Data Ontap · Netapp
8.3.2; 9.0; 9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7947
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7947
Vendor Advisory
https://kb.netapp.com/support/s/article/NTAP-20170630-0001
More from Clustered Data Ontap
9.0
CVE-2021-40438
mod_proxy SSRF
7.5
CVE-2015-5477
ISC BIND Data Processing Errors Vulnerability
9.8
CVE-2024-38476
Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect
9.8
CVE-2024-38474
Apache HTTP Server weakness with encoded question marks in backreferences
9.8
CVE-2022-32221
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been…