CVE-2017-14053

High

Published: 01/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

NetApp OnCommand Unified Manager for Clustered Data ONTAP before version 7.2P1 does not set the secure flag for an unspecified cookie in an HTTPS session, making it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.

Risk Assessment

Attackers may intercept sensitive session data, potentially leading to unauthorized access to the system.

Recommendation

It is recommended to upgrade to version 7.2P1 or later to ensure proper cookie security in HTTPS sessions.

Other vulnerabilities in NetApp OnCommand Unified Manager for Clustered Data ONTAP

CVE-2016-6667Critical
NetApp OnCommand Unified Manager for Clustered Data ONTAP versions 6.3 through 6.4P1 contain a default privileged account, allowing remote attackers to execute arbitrary code via unspecified vectors.

Original NVD description (English source)

NetApp OnCommand Unified Manager for Clustered Data ONTAP before 7.2P1 does not set the secure flag for an unspecified cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.