CVE-2022-23235
First published: Thu Aug 25 2022(Updated: )
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.10P1 are susceptible to a vulnerability which could allow an attacker to discover cluster, node and Active IQ Unified Manager specific information via AutoSupport telemetry data that is sent even when AutoSupport has been disabled.
Credit: security-alert@netapp.com security-alert@netapp.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Netapp Active Iq Unified Manager Linux | <9.10 | |
| Netapp Active Iq Unified Manager Vmware Vsphere | <9.10 | |
| Netapp Active Iq Unified Manager Windows | <9.10 | |
| Netapp Active Iq Unified Manager Linux | =9.10 | |
| Netapp Active Iq Unified Manager Vmware Vsphere | =9.10 | |
| Netapp Active Iq Unified Manager Windows | =9.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-23235?
CVE-2022-23235 is a vulnerability in Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.10P1 that allows an attacker to discover cluster, node, and Active IQ Unified Manager specific information via AutoSupport telemetry data.
Which software versions are affected by CVE-2022-23235?
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions up to exclusive 9.10 are affected by CVE-2022-23235.
What is the severity of CVE-2022-23235?
CVE-2022-23235 has a severity rating of 5.3 (Medium).
How can an attacker exploit CVE-2022-23235?
An attacker can exploit CVE-2022-23235 by intercepting the AutoSupport telemetry data sent by Active IQ Unified Manager and extracting cluster, node, and Active IQ Unified Manager specific information.
Is there a patch or update available for CVE-2022-23235?
Yes, the vulnerability can be fixed by upgrading Active IQ Unified Manager to version 9.10P1 or later.
- agent/author
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/remedy
- agent/severity
- agent/references
- agent/softwarecombine
- agent/description
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/netapp
- canonical/netapp active iq unified manager linux
- canonical/netapp active iq unified manager vmware vsphere
- canonical/netapp active iq unified manager windows
- version/netapp active iq unified manager linux/9.10
- version/netapp active iq unified manager vmware vsphere/9.10
- version/netapp active iq unified manager windows/9.10