CVE-2022-38732
CVE-2022-38732 is a high-severity vulnerability in Netapp Snapcenter with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-358.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- EPSS exploit prediction: 1% (45th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-358
- Affected product: Netapp Snapcenter
- Published:
- Last modified:
Description
SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain types of attacks that otherwise would be prevented.
Frequently asked questions
- What is CVE-2022-38732?
- SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain types of attacks that otherwise would be prevented.
- How severe is CVE-2022-38732?
- CVE-2022-38732 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2022-38732 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2022-38732?
- CVE-2022-38732 affects Netapp Snapcenter. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2022-38732?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2022-38732 published?
- CVE-2022-38732 was published on 2022-09-29 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:netapp:snapcenter:*:*:*:*:*:*:*:*
More vulnerabilities in Netapp Snapcenter
- CVE-2021-44228 — Critical (CVSS 10.0): Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in…
- CVE-2025-26512 — Critical (CVSS 9.9): SnapCenter versions prior to 6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an authenticated…
- CVE-2023-1096 — Critical (CVSS 9.8): SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a…
- CVE-2022-33980 — Critical (CVSS 9.8): Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and…
- CVE-2022-2274 — Critical (CVSS 9.8): The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA…
- CVE-2021-3711 — Critical (CVSS 9.8): In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt().…
All CVEs affecting Netapp Snapcenter →
Other CWE-358 vulnerabilities
- CVE-2018-0268 — Critical (CVSS 10.0): A vulnerability in the container management subsystem of Cisco Digital Network Architecture (DNA) Center could allow an…
- CVE-2022-25152 — Critical (CVSS 9.9): The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures.…
- CVE-2025-66603 — Critical (CVSS 9.8): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts the…
- CVE-2025-62583 — Critical (CVSS 9.8): Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.
- CVE-2023-3266 — Critical (CVSS 9.8): A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all…
- CVE-2019-6742 — Critical (CVSS 9.8): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9…