Netapp Element Plug-In For vCenter Server vulnerabilities

9 CVEs affecting Netapp Element Plug-In For vCenter Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-2048, published 2022-07-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-34429, published 2021-07-15. Medium severity, CVSS 5.3. EPSS: 99.3% chance of exploitation in the next 30 days. For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security…
CVE-2021-28164, published 2021-04-01. Medium severity, CVSS 5.3. EPSS: 82.4% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF…
CVE-2020-27223, published 2021-02-26. Medium severity, CVSS 5.3. EPSS: 78% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q)…
CVE-2021-28163, published 2021-04-01. Low severity, CVSS 2.7. EPSS: 4.2% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a…
CVE-2022-2048, published 2022-07-07. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and…
CVE-2021-26987, published 2021-03-15. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to…
CVE-2019-5492, published 2019-04-29. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. Element Plug-in for vCenter Server versions prior to 4.2.3 may disclose sensitive account information to an unauthenticated attacker. NetApp HCI Compute Node versions prior to 1.4P2 bundle affected…
CVE-2022-2047, published 2022-07-07. Low severity, CVSS 2.7. EPSS: 1.3% chance of exploitation in the next 30 days. In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly…
CVE-2021-34428, published 2021-06-22. Low severity, CVSS 3.5. EPSS: 1% chance of exploitation in the next 30 days. For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID…