Host Header Injection Vulnerability in E-Series SANtricity OS Controller Software by NetApp
CVE-2022-23237

6.1MEDIUM

Key Information:

Vendor

Netapp

Status
E-series Santricity Os Controller Software 11.x
Vendor
CVE Published:
2 June 2022

What is CVE-2022-23237?

The E-Series SANtricity OS Controller Software versions 11.x up to 11.70.2 are susceptible to host header injection vulnerabilities. These vulnerabilities allow attackers to manipulate HTTP headers, leading to potential redirection of users to harmful websites. This can pose a serious security risk as it exploits the trust of the web application, redirecting users unknowingly to malicious sites, thereby compromising sensitive data.

Affected Version(s)

E-Series SANtricity OS Controller Software 11.x 11.x through 11.70.2

References

https://security.netapp.com/advisory/NTAP-20220527-0002/
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2022-23237 : Host Header Injection Vulnerability in E-Series SANtricity OS Controller Software by NetApp