CVE-2024-21985 Privilege Escalation Vulnerability in ONTAP 9
Authenticated users with multiple roles can bypass REST API restrictions to view sensitive data or modify settings, potentially causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-21985?
CVE-2024-21985 is a high-severity vulnerability in Netapp Clustered Data Ontap, published on 26 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user with multiple remote accounts with differing roles to perform actions via REST API beyond their intended privilege. Possible actions include viewing limited configuration details and metrics or modifying limited settings, some of which could result in a Denial of Service (DoS).
Weakness: CWE-269
Which versions are affected by CVE-2024-21985?
It affects 1 product.
Products include Netapp Clustered Data Ontap.
How do I fix CVE-2024-21985?
No fix has been published for CVE-2024-21985 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-21985 being exploited?
There is no known exploitation of CVE-2024-21985 in the wild and no public exploit code.
Other vulnerabilities in Netapp Clustered Data Ontap
Sources
Also known as GHSA-3fg7-rwvx-xrf8.