Vulnerability · Published Dec 15, 2023 · Assigned by netapp
CVE-2023-27317Information Disclosure Vulnerability in ONTAP 9
Medium 4.3
In plain English
A medium-severity information exposure in ONTAP 9 from NetApp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a vulnerability which will cause all SAS-attached FIPS 140-2 drives to become unlocked after a system reboot or power cycle or a single SAS-attached FIPS 140-2 drive to become unlocked after reinsertion. This could lead to disclosure of sensitive information to an attacker with physical access to the unlocked drives.
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N