PT-2024-19139 · Netapp · Ontap

Published 2024-01-26 · Updated 2024-02-05 · CVE-2024-21985

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions ONTAP 9 versions prior to 9.9.1P18 ONTAP 9 versions prior to 9.10.1P16 ONTAP 9 versions prior to 9.11.1P13 ONTAP 9 versions prior to 9.12.1P10 ONTAP 9 versions prior to 9.13.1P4

Description The issue allows an authenticated user with multiple remote accounts and differing roles to perform actions via the REST API beyond their intended privilege. Possible actions include viewing limited configuration details and metrics or modifying limited settings, some of which could result in a Denial of Service (DoS).

Recommendations For versions prior to 9.9.1P18, update to version 9.9.1P18 or later. For versions prior to 9.10.1P16, update to version 9.10.1P16 or later. For versions prior to 9.11.1P13, update to version 9.11.1P13 or later. For versions prior to 9.12.1P10, update to version 9.12.1P10 or later. For versions prior to 9.13.1P4, update to version 9.13.1P4 or later. As a temporary workaround, consider restricting access to the REST API until a patch is applied.

Fix

DoS

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2024-21985

Affected Products

Ontap

References · 5

• https://osv.dev/vulnerability/CVE-2024-21985 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21985 · Security Note
• https://security.netapp.com/advisory/ntap-20240126-0001 · Vendor Advisory
• https://twitter.com/CVEnew/status/1750916184198000673 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1750937478947570071 · Twitter Post