CVE-2021-27003 : Clustered Data ONTAP versions prior to 9.5P18, 9.6P15, 9.7P14, 9.8P5 and 9.9.1 a

Clustered Data ONTAP versions prior to 9.5P18, 9.6P15, 9.7P14, 9.8P5 and 9.9.1 are missing an X-Frame-Options header which could allow a clickjacking attack.

Published 2021-10-12 18:15:08

Updated 2021-10-18 20:00:56

Source NetApp, Inc.

View at NVD, CVE.org

Products affected by CVE-2021-27003

Netapp » Clustered Data Ontap
Versions before (<) 9.5
cpe:2.3:o:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.6
cpe:2.3:o:netapp:clustered_data_ontap:9.6:-:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.6 Update P1
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p1:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.6 Update P3
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p3:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.6 Update P4
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p4:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.6 Update P7
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p7:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.6 Update P8
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p8:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.5 Update P6
cpe:2.3:o:netapp:clustered_data_ontap:9.5:p6:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.5 Update P8
cpe:2.3:o:netapp:clustered_data_ontap:9.5:p8:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.5 Update P9
cpe:2.3:o:netapp:clustered_data_ontap:9.5:p9:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.7
cpe:2.3:o:netapp:clustered_data_ontap:9.7:-:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.7 Update P12
cpe:2.3:o:netapp:clustered_data_ontap:9.7:p12:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.8
cpe:2.3:o:netapp:clustered_data_ontap:9.8:-:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.5
cpe:2.3:o:netapp:clustered_data_ontap:9.5:-:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.5 Update P12
cpe:2.3:o:netapp:clustered_data_ontap:9.5:p12:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.5 Update P13
cpe:2.3:o:netapp:clustered_data_ontap:9.5:p13:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-27003

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 34 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-27003

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
4.7	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: None Integrity: Low Availability: None

CWE ids for CVE-2021-27003

CWE-1021 Improper Restriction of Rendered UI Layers or Frames

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-27003

https://security.netapp.com/advisory/ntap-20211012-0001/

CVE-2021-27003 X-Frame-Options Header Vulnerability in Clustered Data ONTAP | NetApp Product Security
Vendor Advisory

Jump to

Vulnerability Details : CVE-2021-27003

Products affected by CVE-2021-27003

Exploit prediction scoring system (EPSS) score for CVE-2021-27003

CVSS scores for CVE-2021-27003

CWE ids for CVE-2021-27003

References for CVE-2021-27003