Vulnerability · Published Jan 26, 2024 · Assigned by netapp

CVE-2024-21985Privilege Escalation Vulnerability in ONTAP 9

High 7.6

In plain English

A high-severity privilege mismanagement in ONTAP 9 from NetApp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.3%top 73.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user with multiple remote accounts with differing roles to perform actions via REST API beyond their intended privilege. Possible actions include viewing limited configuration details and metrics or modifying limited settings, some of which could result in a Denial of Service (DoS).

Affected products (as reported)

Vendor	Product	Versions
NetApp	ONTAP 9	9.0 – before 9.9.1P189.10.1 – before 9.10.1P169.11.1 – before 9.11.1P139.12.1 – before 9.12.1P109.13.1 – before 9.13.1P4

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

References

https://security.netapp.com/advisory/ntap-20240126-0001/