CVE-2024-21985

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21985
ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user with multiple remote accounts with differing roles to perform actions via REST API beyond their intended privilege. Possible actions include viewing limited configuration details and metrics or modifying limited settings, some of which could result in a Denial of Service (DoS).

7.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://security.netapp.com/advisory/ntap-20240126-0001/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:9.9.1:-:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:9.10.1:-:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:9.11.1:-:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:9.12.1:-:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:9.13.1:-:*:*:*:*:*:*
History

05 Feb 2024, 18:32

Type Values Removed Values Added
First Time Netapp clustered Data Ontap
Netapp
CWE NVD-CWE-noinfo
References () https://security.netapp.com/advisory/ntap-20240126-0001/ - () https://security.netapp.com/advisory/ntap-20240126-0001/ - Vendor Advisory
Summary
  • (es) Las versiones de ONTAP 9 anteriores a 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 y 9.13.1P4 son susceptibles a una vulnerabilidad que podría permitir a un usuario autenticado con múltiples cuentas remotas con diferentes roles realizar acciones a través de la API REST más allá de su privilegio pretendido. Las posibles acciones incluyen ver métricas y detalles de configuración limitados o modificar configuraciones limitadas, algunas de las cuales podrían resultar en una denegación de servicio (DoS).
CPE cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:9.12.1:-:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:9.9.1:-:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:9.13.1:-:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:9.10.1:-:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:9.11.1:-:*:*:*:*:*:*

26 Jan 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-26 16:15

Updated : 2024-02-05 18:32

NVD link : CVE-2024-21985

Mitre link : CVE-2024-21985

CVE.ORG link : CVE-2024-21985

JSON object : View

Products Affected

netapp

  • clustered_data_ontap
CWE
NVD-CWE-noinfo CWE-269

Improper Privilege Management