NetApp OnCommand Unified Manager Core Package CVE-2017-7236 SQL Injection Vulnerability

Bugtraq ID:	98675
Class:	Input Validation Error
CVE:	CVE-2017-7236
Remote:	Yes
Local:	No
Published:	May 17 2017 12:00AM
Updated:	May 17 2017 12:00AM
Credit:	Timo Schmid from ERNW Company
Vulnerable:	NetApp OnCommand Unified Manager Core Package 5.2 NetApp OnCommand Unified Manager Core Package 5.1 NetApp OnCommand Unified Manager Core Package 5.0
Not Vulnerable:	NetApp OnCommand Unified Manager Core Package 5.2.2P1

NetApp OnCommand Unified Manager Core Package CVE-2017-7236 SQL Injection Vulnerability

NetApp OnCommand Unified Manager Core Package is prone to an unspecified SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to obtain sensitive information from the database.

NetApp OnCommand Unified Manager Core Package 5.x versions prior to 5.2.2P1 are vulnerable.

NetApp OnCommand Unified Manager Core Package CVE-2017-7236 SQL Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NetApp OnCommand Unified Manager Core Package CVE-2017-7236 SQL Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.