CVE-2024-21982

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

ONTAP versions 9.4 and higher are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information to unprivileged attackers when the object-store profiler command is being run by an administrative user.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
NetApp	ONTAP 9	>= 9.4, < 9.8P21; >= 9.9.1, < 9.9.1P18; >= 9.10.1, < 9.10.1P16; >= 9.11.1, < 9.11.1P13; >= 9.12.1, < 9.12.1P8; >= 9.13.1, < 9.13.1P4

References

https://security.netapp.com/advisory/ntap-20240111-0001/Vendor Advisory
https://security.netapp.com/advisory/ntap-20240111-0001/Vendor Advisory

Timeline

Published: Jan 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-219836.5StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 are susceptible to a Denial of Service (DoS) vulnerability. Successful CVE-2024-219846.9StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 are susceptible to a difficult to exploit Reflected Cross-Site Scripting CVE-2024-219857.6ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an a CVE-2024-219875.4SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modif CVE-2024-219885.3StorageGRID (formerly StorageGRID Webscale) versions prior to 11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive information CVE-2024-219898.8ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x are susceptible to a vulnerability which when successf CVE-2024-21995.7A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash w CVE-2024-219909.8ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an att CVE-2024-219936.5SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability which could allow an authenticated attacker to discover plaintext cr CVE-2024-219944.3StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9 are susceptible to a Denial of Service (DoS) vulnerability. Successful ex CVE-2024-22006.1The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_subject’ para CVE-2024-220027.8CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the insta