Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

NetApp Element Plug-in may expose account data

CVE-2019-5492 · published 7 years ago
Summary

The Element Plug-in for vCenter Server in NetApp HCI Compute Nodes before version 1.4P2 can reveal sensitive account information to anyone on the network. This could allow an attacker to see usernames and passwords without logging in. Update the plug-in to the latest version or apply the vendor's recommended patch to protect the data.

What to do
  • Update netapp element_plug-in_for_vcenter_server to version 4.2.3 or later.
Affected software
VendorProductAffected versions
netapp hyper_converged_infrastructure_compute_node <= 1.4
cpe:2.3:a:netapp:hyper_converged_infrastructure_compute_node:*:*:*:*:*:*:*:*
netapp element_plug-in_for_vcenter_server < 4.2.3
cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:*:*:*:*:*:*:*:*
Original advisory text
Element Plug-in for vCenter Server versions prior to 4.2.3 may disclose sensitive account information to an unauthenticated attacker. NetApp HCI Compute Node versions prior to 1.4P2 bundle affected...
Element Plug-in for vCenter Server versions prior to 4.2.3 may disclose sensitive account information to an unauthenticated attacker. NetApp HCI Compute Node versions prior to 1.4P2 bundle affected versions of Element Plug-in for vCenter Server.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Timeline
Published29 Apr 2019
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-5492 · NVD
Track software like this
Free during beta