CVE-2024-21985

ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user with multiple remote accounts with differing roles to perform actions via REST API beyond their intended privilege. Possible actions include viewing limited configuration details and metrics or modifying limited settings, some of which could result in a Denial of Service (DoS).

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://security.netapp.com/advisory/ntap-20240126-0001/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:netapp:clustered_data_ontap::::::::
	cpe:2.3:a:netapp:clustered_data_ontap::::::::
	cpe:2.3:a:netapp:clustered_data_ontap::::::::
	cpe:2.3:a:netapp:clustered_data_ontap::::::::
	cpe:2.3:a:netapp:clustered_data_ontap::::::::
	cpe:2.3:a:netapp:clustered_data_ontap:9.9.1:-::::::
	cpe:2.3:a:netapp:clustered_data_ontap:9.10.1:-::::::
	cpe:2.3:a:netapp:clustered_data_ontap:9.11.1:-::::::
	cpe:2.3:a:netapp:clustered_data_ontap:9.12.1:-::::::
	cpe:2.3:a:netapp:clustered_data_ontap:9.13.1:-::::::

History

No history.

Information

Published : 2024-01-26 16:15

Updated : 2024-02-05 18:32

NVD link : CVE-2024-21985

Mitre link : CVE-2024-21985

CVE.ORG link : CVE-2024-21985

JSON object : View

Products Affected

netapp

clustered_data_ontap

CWE

NVD-CWE-noinfo CWE-269

Improper Privilege Management

{"id": "CVE-2024-21985", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-alert@netapp.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "published": "2024-01-26T16:15:22.597", "references": [{"url": "https://security.netapp.com/advisory/ntap-20240126-0001/", "tags": ["Vendor Advisory"], "source": "security-alert@netapp.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "security-alert@netapp.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 \nand 9.13.1P4 are susceptible to a vulnerability which could allow an \nauthenticated user with multiple remote accounts with differing roles to\n perform actions via REST API beyond their intended privilege. Possible \nactions include viewing limited configuration details and metrics or \nmodifying limited settings, some of which could result in a Denial of \nService (DoS).\n\n\n\n"}, {"lang": "es", "value": "Las versiones de ONTAP 9 anteriores a 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 y 9.13.1P4 son susceptibles a una vulnerabilidad que podr\u00eda permitir a un usuario autenticado con m\u00faltiples cuentas remotas con diferentes roles realizar acciones a trav\u00e9s de la API REST m\u00e1s all\u00e1 de su privilegio pretendido. Las posibles acciones incluyen ver m\u00e9tricas y detalles de configuraci\u00f3n limitados o modificar configuraciones limitadas, algunas de las cuales podr\u00edan resultar en una denegaci\u00f3n de servicio (DoS)."}], "lastModified": "2024-02-05T18:32:52.040", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1096408-669B-4944-A3C7-CDD8FB3215BB", "versionEndExcluding": "9.9.1", "versionStartIncluding": "9.0"}, {"criteria": "cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9AB5E20-70A4-412E-B0CE-8D56666D2FFA", "versionEndExcluding": "9.10.1", "versionStartIncluding": "9.10.0"}, {"criteria": "cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "002B4EC4-81D8-4449-A225-3137D37796E0", "versionEndExcluding": "9.11.1", "versionStartIncluding": "9.11.0"}, {"criteria": "cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46A8E230-FCE4-44CA-9FEC-E4994970776E", "versionEndExcluding": "9.12.1", "versionStartIncluding": "9.12.0"}, {"criteria": "cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18E30F09-FA25-4B94-9372-5B5FFC4528C4", "versionEndExcluding": "9.13.1", "versionStartIncluding": "9.13.0"}, {"criteria": "cpe:2.3:a:netapp:clustered_data_ontap:9.9.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0284DC1-9FAA-4979-82C3-AB7347614C80"}, {"criteria": "cpe:2.3:a:netapp:clustered_data_ontap:9.10.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1A4278F-D9A9-4C39-AC53-AB35DB921E02"}, {"criteria": "cpe:2.3:a:netapp:clustered_data_ontap:9.11.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "366B49CA-EB3B-44A1-9DB4-9D24A0F427E5"}, {"criteria": "cpe:2.3:a:netapp:clustered_data_ontap:9.12.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD223C45-CF1B-4931-9753-503923FCFE25"}, {"criteria": "cpe:2.3:a:netapp:clustered_data_ontap:9.13.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E1CD626-B5E9-4166-A539-09305A5B9696"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@netapp.com"}