Read the docs
TI-2019-03900 Aliases CVE-2019-5492GHSA-m5cm-69xp-qf52

Element Plug-in for vCenter Server versions prior to 4.2.3 may disclose sensitive account…

Priority LOW 36Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Element Plug-in for vCenter Server versions prior to 4.2.3 may disclose sensitive account information to an unauthenticated attacker. NetApp HCI Compute Node versions prior to 1.4P2 bundle affected versions of Element Plug-in for vCenter Server.

Why it matters now

EPSS 0.01542 75th percentileScored 2026-11-07
Fix Fixed Element Plug-in for vCenter Server (NetApp, Inc.): 4.2.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NetAppElement Plug-in for vCenter Serverbefore 4.2.34.2.3Patch availableCNA
  • Element Plug-in for vCenter Server VendorNetApp Affected before 4.2.3 Fixed in 4.2.3 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:netapp:hyper_converged_infrastructure_compute_node:*:*:*:*:*:*:*:*up to 1.4VulnerableNetApp
cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:*:*:*:*:*:*:*:*before 4.2.3VulnerableNetApp
  • cpe:2.3:a:netapp:hyper_converged_infrastructure_compute_node:*:*:*:*:*:*:*:* Versions up to 1.4 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:*:*:*:*:*:*:*:* Versions before 4.2.3 Vulnerable ·NetApp

Remediation

  • Fix · CNA Element Plug-in for vCenter Server (NetApp, Inc.) Fixed in 4.2.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-5492
  2. 2026-10-03 Alias added: GHSA-m5cm-69xp-qf52

References

Advisory 1

  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2021-09393 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2021-08570 Element Plug-in for vCenter Server incorporates SpringBoot Framework. CVSS 3.1CRITICAL 9.8
  • TI-2022-01897 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-09392 Information disclosure in Eclipse Jetty CVSS 3.1LOW 2.7
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences