Cyber Resilience

CVE-2021-22096

Medium

Published: 28 October 2021

Published
28 October 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0022 44.8th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-22096 is a medium-severity Improper Output Neutralization for Logs (CWE-117) vulnerability in Netapp Active Iq Unified Manager. Its CVSS base score is 4.3 (Medium).

Operationally, ranked at the 44.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

CWE(s)
CWE-117NVD-CWE-Other

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

vmware
spring framework
5.2.0 — 5.2.17 · 5.3.0 — 5.3.10
netapp
active iq unified manager
all versions
netapp
management services for element software and netapp hci
all versions
netapp
metrocluster tiebreaker
all versions
netapp
snap creator framework
all versions
netapp
snapcenter
all versions
oracle
communications cloud native core console
1.9.0
oracle
communications cloud native core service communication proxy
1.15.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-1 Policy and Procedures
addresses: CWE-117

Policy and procedures require sanitization and neutralization when generating audit logs to avoid injection issues.

SI-15 Information Output Filtering
addresses: CWE-117

Requiring output to conform to expected content prevents unneutralized data from reaching logs.

References