CVE-2024-21984 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Reflected XSS in NetApp StorageGRID allows attackers to view or modify configuration and user accounts by tricking privileged users into clicking crafted links.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-21984?
CVE-2024-21984 is a medium-severity cross-site scripting vulnerability in Netapp Storagegrid, published on 16 Feb 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 are susceptible to a difficult to exploit Reflected Cross-Site Scripting (XSS) vulnerability. Successful exploit requires the attacker to know specific information about the target instance and trick a privileged user into clicking a specially crafted link. This could allow the attacker to view or modify configuration settings or add or modify user accounts.
Weakness: CWE-79
Which versions are affected by CVE-2024-21984?
It affects 1 product.
Products include Netapp Storagegrid.
How do I fix CVE-2024-21984?
No fix has been published for CVE-2024-21984 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-21984 being exploited?
There is no known exploitation of CVE-2024-21984 in the wild and no public exploit code.
Other vulnerabilities in Netapp Storagegrid
- CVE-2025-25291 ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
- CVE-2025-25292 Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)
- CVE-2025-26515 CVE-2025-26515 Server-Side Request Forgery Vulnerability in StorageGRID (formerly StorageGRID Webscale)
- CVE-2022-38734 Denial of service in Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
- CVE-2022-23233 Denial of service in StorageGRID (formerly StorageGRID Webscale)
Sources
Also known as GHSA-mc27-8ccr-v5m9.