Netapp Metrocluster Tiebreaker vulnerabilities

3 CVEs affecting Netapp Metrocluster Tiebreaker, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22968, published 2022-04-14.

More from Netapp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-22968, published 2022-04-14. Medium severity, CVSS 5.3. EPSS: 5.7% chance of exploitation in the next 30 days. In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not…
• CVE-2016-6820, published 2017-01-11. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. MetroCluster Tiebreaker for clustered Data ONTAP in versions before 1.2 discloses sensitive information in cleartext which may be viewed by an unauthenticated user.
• CVE-2021-22096, published 2021-10-28. Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days. In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.