NetApp StorageGRID Webscale CVE-2017-12422 Arbitrary File Deletion Vulnerability

Bugtraq ID:	100535
Class:	Design Error
CVE:	CVE-2017-12422
Remote:	Yes
Local:	No
Published:	Aug 25 2017 12:00AM
Updated:	Aug 25 2017 12:00AM
Credit:	The vendor reported the issue.
Vulnerable:	NetApp StorageGRID Webscale 10.4 NetApp StorageGRID Webscale 10.3 NetApp StorageGRID Webscale 10.2
Not Vulnerable:	NetApp StorageGRID Webscale 10.4.0.2 NetApp StorageGRID Webscale 10.3.0.4 NetApp StorageGRID Webscale 10.2.2.3

NetApp StorageGRID Webscale CVE-2017-12422 Arbitrary File Deletion Vulnerability

NetApp StorageGRID Webscale is prone to an arbitrary-file-deletion vulnerability.

An attacker can exploit this issue to delete arbitrary files on a vulnerable computer with the affected application.

StorageGRID Webscale versions 10.2.0 through 10.2.2.2, 10.3.0 through 10.3.0.3, and 10.4.0 through 10.4.0.1 are affected.

NetApp StorageGRID Webscale CVE-2017-12422 Arbitrary File Deletion Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

NetApp StorageGRID Webscale CVE-2017-12422 Arbitrary File Deletion Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

NetApp StorageGRID Webscale CVE-2017-12422 Arbitrary File Deletion Vulnerability

References:

• NetApp Homepage (NetApp)
  
• CVE-2017-12422 Unauthorized Object Deletion Vulnerability in StorageGRID WebScal (NetApp)