NetApp Clustered Data ONTAP Storage Virtual Machine boundary: MULTI-TENANT ISOLATION: a user in one SVM determines

Impact

MULTI-TENANT ISOLATION: a user in one SVM determines whether data exists on a different SVM. The SVM is the tenant boundary in ONTAP, so this leaks the shape of another customer's namespace across it.

Who can reach it

An authenticated user on an adjacent network with access to any SVM on a Clustered Data ONTAP system earlier than 9.3P20 or 9.5P15.

What to do

Upgrade to 9.3P20 / 9.5P15 or later. If SVMs are being used as a hard tenant boundary, treat namespace metadata as having been observable until the upgrade lands.

References