Read the docs
TI-2016-05928 Aliases CVE-2016-6904GHSA-p52f-9xgh-mjcf

Credentials management flaw in NetApp VASA Provider for Clustered Data ONTAP

Priority LOW 38CWE-255Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could allow an unauthenticated attacker to obtain authentication credentials.

Why it matters now

EPSS 0.01178 67th percentileScored 2026-11-07
Fix Fixed VASA Provider for Clustered Data ONTAP (NetApp): 7.0P1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NetAppVASA Provider for Clustered Data ONTAPbefore 7.0P17.0P1Patch availableCNA
  • VASA Provider for Clustered Data ONTAP VendorNetApp Affected before 7.0P1 Fixed in 7.0P1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netapp:vasa_provider:*:*:*:*:*:clustered_data_ontap:*:*up to 7.0VulnerableNetApp
  • cpe:2.3:a:netapp:vasa_provider:*:*:*:*:*:clustered_data_ontap:*:* Versions up to 7.0 Vulnerable ·NetApp

Remediation

  • Fix · CNA VASA Provider for Clustered Data ONTAP (NetApp) Fixed in 7.0P1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-6904
  2. 2026-10-03 Alias added: GHSA-p52f-9xgh-mjcf

References

Advisory 1

  • TI-2018-11033 OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying… CVSS 3.1MEDIUM 5.9
  • TI-2016-08749 sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL… CVSS 3.1HIGH 7.5
  • TI-2018-04767 An integer overflow in the implementation of the posix_memalign in memalign functions in… CVSS 3.0CRITICAL 9.8
  • TI-2018-02135 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). CVSS 3.1HIGH 8.3
  • TI-2018-02134 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). CVSS 3.1HIGH 8.3
  • TI-2020-16542 In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and… CVSS 3.1HIGH 7.0
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences