PT-2024-3870 · Netapp · Ontap

Published 2024-01-11 · Updated 2024-01-18 · CVE-2024-21982

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ONTAP versions 9.4 and higher

Description: The issue is related to the Object-Store Profiler Command Handler component in the Clustered Data ONTAP operating system for data storage systems. It involves the disclosure of sensitive information during data transmission. When exploited, this could allow a remote attacker to gain unauthorized access to protected information by executing commands with administrative privileges. The vulnerability can be exploited when the object-store profiler command is run by an administrative user.

Recommendations: For ONTAP versions 9.4 and higher, consider restricting access to the object-store profiler command to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the execution of commands with administrative privileges to necessary cases only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-201

Related Identifiers

BDU:2024-04271

CVE-2024-21982

Affected Products

Ontap

References · 7

• https://security.netapp.com/advisory/ntap-20240111-0001 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04271 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21982 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21982 · Vendor Advisory
• https://t.me/cvenotify/67146 · Telegram Post
• https://twitter.com/CVEnew/status/1745591089002594334 · Twitter Post
• https://vuldb.com/?id.250527 · Note