{"api_version":"1","generated_at":"2026-07-24T19:36:08+00:00","cve":"CVE-2019-5495","urls":{"html":"https://cve.report/CVE-2019-5495","api":"https://cve.report/api/cve/CVE-2019-5495.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-5495","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-5495"},"summary":{"title":"CVE-2019-5495","description":"OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.","state":"PUBLIC","assigner":"security-alert@netapp.com","published_at":"2019-05-10 20:29:00","updated_at":"2019-05-14 17:15:00"},"problem_types":["CWE-254"],"metrics":[],"references":[{"url":"https://security.netapp.com/advisory/ntap-20190509-0007/","name":"https://security.netapp.com/advisory/ntap-20190509-0007/","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"Missing HTTP Security Headers in OnCommand Unified Manager for VMware vSphere, Linux and Windows 7.3 and above | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-5495","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5495","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"5495","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"oncommand_unified_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"linux","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"5495","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"oncommand_unified_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"vmware_vsphere","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"5495","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"oncommand_unified_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"windows","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"5495","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"oncommand_unified_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"linux","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"5495","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"oncommand_unified_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"vmware_vsphere","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"5495","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"oncommand_unified_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"windows","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2019-5495","ASSIGNER":"security-alert@netapp.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"NetApp","product":{"product_data":[{"product_name":"OnCommand Unified Manager for VMware vSphere,Linux and Windows 7.2 and above","version":{"version_data":[{"version_value":"Versions prior to 9.5"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Information Disclosure"}]}]},"references":{"reference_data":[{"refsource":"CONFIRM","name":"https://security.netapp.com/advisory/ntap-20190509-0007/","url":"https://security.netapp.com/advisory/ntap-20190509-0007/"}]},"description":{"description_data":[{"lang":"eng","value":"OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors."}]}},"nvd":{"publishedDate":"2019-05-10 20:29:00","lastModifiedDate":"2019-05-14 17:15:00","problem_types":["CWE-254"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vmware_vsphere:*:*","versionEndExcluding":"9.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:*","versionEndExcluding":"9.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:linux:*:*","versionEndExcluding":"9.5","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"5495","Ordinal":"143115","Title":"CVE-2019-5495","CVE":"CVE-2019-5495","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"5495","Ordinal":"1","NoteData":"OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"5495","Ordinal":"2","NoteData":"2019-05-10","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"5495","Ordinal":"3","NoteData":"2019-05-10","Type":"Other","Title":"Modified"}]}}}