7.5Yüksek
CVE-2025-26515CVE-2025-26515 Server-Side Request Forgery Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Açıklama
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without Single Sign-on enabled are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an unauthenticated attacker to change the password of any Grid Manager or Tenant Manager non-federated user.
Zayıflık türü (CWE):
CWE-918
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| NetApp | StorageGRID | < 11.8.0.15, < 11.9.0.8 |
Kaynaklar ve yamalar
- https://security.netapp.com/advisory/NTAP-20250910-0002 Vendor Advisory
CPE eşleşmeleri (NVD) (2)
cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*< 11.8.0.15cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*≥ 11.9.0 < 11.9.0.8