NetApp ONTAP S3 Information Disclosure Vulnerability (NTAP-20260304-0001)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(301982);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/13");

  script_cve_id("CVE-2026-22052");
  script_xref(name:"IAVB", value:"2026-B-0060");

  script_name(english:"NetApp ONTAP S3 Information Disclosure Vulnerability (NTAP-20260304-0001)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by an Information Disclosure Vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of NetApp ONTAP running on the remote host is 9.12.1 prior to 9.12.1P20, 9.13.x prior to 9.13.1P19,
9.14.x prior to 9.14.1P16, 9.15.x prior to 9.15.1P16, 9.16.x prior to 9.16.1P8, 9.17.x prior to 9.17.1P1, or
9.18.x prior to 9.18.1. It is, therefore, affected by an Information Disclosure Vulnerability as detailed in the
NTAP-20260304-0001 advisory.

  - ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability.
    Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for
    which they lack permission. (CVE-2026-22052)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.netapp.com/advisory/NTAP-20260304-0001/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to NetApp ONTAP version 9.12.1P20, 9.13.1P19, 9.14.1P16, 9.15.1P16, 9.16.1P8, 9.17.1P1, 9.18.1, or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-22052");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:netapp:data_ontap");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("netapp_ontap_detect.nbin");
  script_require_keys("Host/NetApp/ONTAP/display_version");

  exit(0);
}

include('vcf.inc');

var app_name = 'NetApp ONTAP';

var app_info = vcf::get_app_info(app:app_name, kb_ver:'Host/NetApp/ONTAP/display_version');

var constraints = [
  { 'min_version': '9.12.1', 'fixed_version': '9.12.1P20' },
  { 'min_version': '9.13.0', 'fixed_version': '9.13.1P19' },
  { 'min_version': '9.14.0', 'fixed_version': '9.14.1P16' },
  { 'min_version': '9.15.0', 'fixed_version': '9.15.1P16' },
  { 'min_version': '9.16.0', 'fixed_version': '9.16.1P8' },
  { 'min_version': '9.17.0', 'fixed_version': '9.17.1P1' },
  { 'min_version': '9.18.0', 'fixed_version': '9.18.1' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);