CVEvulnerability
CVE-2016-3063
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-02-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-116
Description
Multiple functions in NetApp OnCommand System Manager before 8.3.2 do not properly escape special characters, which allows remote authenticated users to execute arbitrary API calls via unspecified vectors.
Affected configurations
• netapp oncommand system manager (<= 8.3.1)
Related
Weakness · CWE (1)
- CWE-116 Improper Encoding or Escaping of Output weakness
References
- https://kb.netapp.com/support/s/article/cve-2016-3063-zapi-injection-vulnerability-in-oncommand-system-manager Patch, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20160310-0004/ security.netapp.com
- https://kb.netapp.com/support/s/article/cve-2016-3063-zapi-injection-vulnerability-in-oncommand-system-manager Patch, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20160310-0004/ security.netapp.com