CVE-2019-5491

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Clustered Data ONTAP versions prior to 9.1P15 and 9.3 prior to 9.3P7 are susceptible to a vulnerability which discloses sensitive information to an unauthenticated user.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
NetApp	Clustered Data ONTAP	Versions 9.0 and higher

References

http://www.securityfocus.com/bid/107183Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20190227-0001/Vendor Advisory
http://www.securityfocus.com/bid/107183Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20190227-0001/Vendor Advisory

Timeline

Published: Feb 27, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-54927.5Element Plug-in for vCenter Server versions prior to 4.2.3 may disclose sensitive account information to an unauthenticated attacker. NetApp CVE-2019-54937.5Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 are susceptible to a vulnerability which discloses information to an unauthenticate CVE-2019-54947.5OnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security headers configured which could allow an attack CVE-2019-54957.5OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which CVE-2019-54967.5Oncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain s CVE-2019-54979.8NetApp AFF A700s Baseboard Management Controller (BMC) firmware versions 1.22 and higher were shipped with a default account enabled that co CVE-2019-54986.5OnCommand Insight versions through 7.3.6 may disclose sensitive account information to an authenticated user.CVE-2019-55007.5Certain versions of the NetApp Service Processor and Baseboard Management Controller firmware allow a remote unauthenticated attacker to cau CVE-2019-55017.5Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 may disclose sensitive LDAP account information to unauthenticated remote attackers CVE-2019-55029.1SMB in Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 has weak cryptography which when exploited could lead to information disclos CVE-2019-55035.3OnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers configured which could allow an attacker t CVE-2019-55049.8ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated re