← Vulnerability feed

Vulnerability record · CVE-2017-15518 · published 23 February 2018

CVE-2017-15518: Netapp oncommand api services information exposure vulnerability

NNetapp · Oncommand Api Services

All versions of OnCommand API Services prior to 2.1 and NetApp Service Level Manager prior to 1.0RC4 log a privileged database user account password. All users are urged to move to a fixed version. Since the affected password is changed during every upgrade/installation no further action is required.

7.8 CVSS 3.1 High EPSS 0.34% · top 75.3% CWE-200 · Information exposure
7.8CVSS 3.1 base score, v2 2.1
0.34%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

All versions of OnCommand API Services prior to 2.1 and NetApp Service Level Manager prior to 1.0RC4 log a privileged database user account password. All users are urged to move to a fixed version. Since the affected password is changed during every upgrade/installation no further action is required.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://security.netapp.com/advisory/NTAP-20180223-0001/ Vendor Advisory
https://security.netapp.com/advisory/NTAP-20180223-0001/ Vendor Advisory

Track CVE-2017-15518 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-10683Dom4j project dom4j xml external entity (xxe) vulnerabilitydom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is po…EPSS 7.3%9.8CVE-2019-14893Fasterxml jackson-databind information exposure vulnerabilityA flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of ma…EPSS 4.1%9.8CVE-2020-8840Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiC…EPSS 27%9.8CVE-2019-20330Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.EPSS 8.6%9.8CVE-2019-17267Fasterxml jackson-databind deserialization of untrusted data vulnerabilityA Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactio…EPSS 4.6%9.8CVE-2019-16942Fasterxml jackson-databind deserialization of untrusted data vulnerabilityA Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for …EPSS 5.7%9.8CVE-2019-16943Fasterxml jackson-databind deserialization of untrusted data vulnerabilityA Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for …EPSS 4.9%9.8CVE-2019-14540Fasterxml jackson-databind deserialization of untrusted data vulnerabilityA Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.EPSS 11%

Source: NIST National Vulnerability Database (record CVE-2017-15518), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.