« Volver al listado

CVE-2024-21990

Estado: AnalizadaCrítica (9.8)—

ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deploy configuration information and modify the account credentials.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Netapp — Ontap Select Deploy Administration Utility

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-21990",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-21990",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-04-23T15:34:29.517252Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-alert@netapp.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@netapp.com",
      "affectedData": [
        {
          "vendor": "NetApp",
          "product": "ONTAP Select Deploy administration utility",
          "versions": [
            {
              "status": "affected",
              "version": "9.12.1",
              "versionType": "patch",
              "lessThanOrEqual": "9.14.1P2"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:netapp:clustered_data_ontap:9.12.1:-:*:*:*:*:*:*"
          ],
          "vendor": "netapp",
          "product": "clustered_data_ontap",
          "versions": [
            {
              "status": "affected",
              "version": "9.12.1"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:netapp:clustered_data_ontap:9.13.1:-:*:*:*:*:*:*"
          ],
          "vendor": "netapp",
          "product": "clustered_data_ontap",
          "versions": [
            {
              "status": "affected",
              "version": "9.13.1"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:netapp:clustered_data_ontap:9.14.0:-:*:*:*:*:*:*"
          ],
          "vendor": "netapp",
          "product": "clustered_data_ontap",
          "versions": [
            {
              "status": "affected",
              "version": "9.14.0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-17T20:15:07.863",
  "references": [
    {
      "url": "https://security.netapp.com/advisory/ntap-20240411-0002/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-alert@netapp.com"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20240411-0002/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-alert@netapp.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-259"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ONTAP Select Deploy administration utility versions 9.12.1.x, \n9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an\n attacker to view Deploy configuration information and modify the \naccount credentials.\n\n\n\n\n"
    },
    {
      "lang": "es",
      "value": "Las versiones 9.12.1.x, 9.13.1.x y 9.14.1.x de la utilidad de administración ONTAP Select Deploy contienen credenciales codificadas que podrían permitir a un atacante ver la información de configuración de Deploy y modificar las credenciales de la cuenta."
    }
  ],
  "lastModified": "2026-06-17T07:10:30.370",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C224CC9-CC03-4268-BEC9-5C70D5B1556D",
              "versionEndIncluding": "9.14.1",
              "versionStartIncluding": "9.12.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-alert@netapp.com"
}