« Volver al listado

CVE-2024-21982

Estado: ModificadaMedia (6.5)—

ONTAP versions 9.4 and higher are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information to unprivileged attackers when the object-store profiler command is being run by an administrative user.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Netapp — Clustered Data Ontap

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-21982",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-21982",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-02-07T20:22:54.494126Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-alert@netapp.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@netapp.com",
      "affectedData": [
        {
          "vendor": "NetApp",
          "product": "ONTAP 9 ",
          "versions": [
            {
              "status": "affected",
              "version": "9.4",
              "lessThan": "9.8P21",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "9.9.1",
              "lessThan": "9.9.1P18",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "9.10.1",
              "lessThan": "9.10.1P16",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "9.11.1",
              "lessThan": "9.11.1P13",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "9.12.1",
              "lessThan": "9.12.1P8",
              "versionType": "patch"
            },
            {
              "status": "affected",
              "version": "9.13.1",
              "lessThan": "9.13.1P4",
              "versionType": "patch"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-01-12T00:15:45.450",
  "references": [
    {
      "url": "https://security.netapp.com/advisory/ntap-20240111-0001/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-alert@netapp.com"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20240111-0001/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ONTAP versions 9.4 and higher are susceptible to a vulnerability \nwhich when successfully exploited could lead to disclosure of sensitive \ninformation to unprivileged attackers when the object-store profiler \ncommand is being run by an administrative user.\n\n"
    },
    {
      "lang": "es",
      "value": "Las versiones de ONTAP 9.4 y superiores son susceptibles a una vulnerabilidad que, cuando se explota con éxito, podría provocar la divulgación de información confidencial a atacantes sin privilegios cuando un usuario administrativo ejecuta el comando del generador de perfiles del almacén de objetos."
    }
  ],
  "lastModified": "2026-06-17T07:10:29.520",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1AAAB2B-2589-4946-BBDD-A873D19326F2",
              "versionEndExcluding": "9.8",
              "versionStartIncluding": "9.4"
            },
            {
              "criteria": "cpe:2.3:o:netapp:clustered_data_ontap:9.8:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2ABBF729-6A69-4CEC-9B3E-735C45D3069E"
            },
            {
              "criteria": "cpe:2.3:o:netapp:clustered_data_ontap:9.9.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A6A96D7-45B2-46BE-8894-6DC3F565A8A4"
            },
            {
              "criteria": "cpe:2.3:o:netapp:clustered_data_ontap:9.10.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21C64ED1-485F-4CCF-8114-70B2987B6674"
            },
            {
              "criteria": "cpe:2.3:o:netapp:clustered_data_ontap:9.11.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FA41D1E-1184-448E-A5E4-7F8FDAACC638"
            },
            {
              "criteria": "cpe:2.3:o:netapp:clustered_data_ontap:9.12.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E7FAAAB-2BE5-4173-8CC6-669A9D29D446"
            },
            {
              "criteria": "cpe:2.3:o:netapp:clustered_data_ontap:9.13.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D704DC8-A679-4293-81CE-70F4FEE89530"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-alert@netapp.com"
}