Search criteria

5 vulnerabilities found for ONTAP 9 by NetApp

CVE-2026-22050 (GCVE-0-2026-22050)

Vulnerability from cvelistv5 – Published: 2026-01-12 17:15 – Updated: 2026-01-13 17:30
VLAI?
Summary
ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none.
CWE
  • 639
Assigner
Impacted products
Vendor Product Version
NETAPP ONTAP 9 Affected: 9.16.1 , < 9.16.1P9 (custom)
Affected: 9.17.1 , < 9.17.1P2 (custom)
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22050",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-12T17:36:52.693542Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-639",
                "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-13T17:30:51.952Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ONTAP 9",
          "vendor": "NETAPP",
          "versions": [
            {
              "lessThan": "9.16.1P9",
              "status": "affected",
              "version": "9.16.1",
              "versionType": "custom"
            },
            {
              "lessThan": "9.17.1P2",
              "status": "affected",
              "version": "9.17.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none."
            }
          ],
          "value": "ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privileged remote attacker to set the snapshot expiry time to none."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "639",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-12T17:15:07.484Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/NTAP-20260112-0001"
        }
      ],
      "source": {
        "advisory": "NTAP-20260112-0001",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2026-22050",
    "datePublished": "2026-01-12T17:15:07.484Z",
    "dateReserved": "2026-01-05T22:47:18.701Z",
    "dateUpdated": "2026-01-13T17:30:51.952Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21985 (GCVE-0-2024-21985)

Vulnerability from cvelistv5 – Published: 2024-01-26 16:01 – Updated: 2025-05-29 15:12
VLAI?
Title
Privilege Escalation Vulnerability in ONTAP 9
Summary
ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user with multiple remote accounts with differing roles to perform actions via REST API beyond their intended privilege. Possible actions include viewing limited configuration details and metrics or modifying limited settings, some of which could result in a Denial of Service (DoS).
CWE
  • CWE-269 - Improper Privilege Management
Assigner
Impacted products
Vendor Product Version
NetApp ONTAP 9 Affected: 9.0 , < 9.9.1P18 (patch)
Affected: 9.10.1 , < 9.10.1P16 (patch)
Affected: 9.11.1 , < 9.11.1P13 (patch)
Affected: 9.12.1 , < 9.12.1P10 (patch)
Affected: 9.13.1 , < 9.13.1P4 (patch)
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:35:34.813Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240126-0001/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21985",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T19:09:09.334429Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-29T15:12:35.934Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ONTAP 9",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThan": "9.9.1P18",
              "status": "affected",
              "version": "9.0",
              "versionType": "patch"
            },
            {
              "lessThan": "9.10.1P16",
              "status": "affected",
              "version": "9.10.1",
              "versionType": "patch"
            },
            {
              "lessThan": "9.11.1P13",
              "status": "affected",
              "version": "9.11.1",
              "versionType": "patch"
            },
            {
              "lessThan": "9.12.1P10",
              "status": "affected",
              "version": "9.12.1",
              "versionType": "patch"
            },
            {
              "lessThan": "9.13.1P4",
              "status": "affected",
              "version": "9.13.1",
              "versionType": "patch"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\u003cp\u003eONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 \nand 9.13.1P4 are susceptible to a vulnerability which could allow an \nauthenticated user with multiple remote accounts with differing roles to\n perform actions via REST API beyond their intended privilege. Possible \nactions include viewing limited configuration details and metrics or \nmodifying limited settings, some of which could result in a Denial of \nService (DoS).\u003c/p\u003e\n\n"
            }
          ],
          "value": "ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 \nand 9.13.1P4 are susceptible to a vulnerability which could allow an \nauthenticated user with multiple remote accounts with differing roles to\n perform actions via REST API beyond their intended privilege. Possible \nactions include viewing limited configuration details and metrics or \nmodifying limited settings, some of which could result in a Denial of \nService (DoS).\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-26T16:01:48.168Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/ntap-20240126-0001/"
        }
      ],
      "source": {
        "advisory": "NTAP-20240126-0001",
        "discovery": "UNKNOWN"
      },
      "title": "Privilege Escalation Vulnerability in ONTAP 9 ",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2024-21985",
    "datePublished": "2024-01-26T16:01:48.168Z",
    "dateReserved": "2024-01-03T19:45:25.346Z",
    "dateUpdated": "2025-05-29T15:12:35.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-21982 (GCVE-0-2024-21982)

Vulnerability from cvelistv5 – Published: 2024-01-11 23:32 – Updated: 2025-06-16 19:48
VLAI?
Title
CVE-2024-21982 Information Disclosure Vulnerability in ONTAP 9
Summary
ONTAP versions 9.4 and higher are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information to unprivileged attackers when the object-store profiler command is being run by an administrative user.
CWE
  • 201
Assigner
Impacted products
Vendor Product Version
NetApp ONTAP 9 Affected: 9.4 , < 9.8P21 (patch)
Affected: 9.9.1 , < 9.9.1P18 (patch)
Affected: 9.10.1 , < 9.10.1P16 (patch)
Affected: 9.11.1 , < 9.11.1P13 (patch)
Affected: 9.12.1 , < 9.12.1P8 (patch)
Affected: 9.13.1 , < 9.13.1P4 (patch)
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:35:34.489Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240111-0001/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21982",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-07T20:22:54.494126Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-16T19:48:30.010Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ONTAP 9 ",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThan": "9.8P21",
              "status": "affected",
              "version": "9.4",
              "versionType": "patch"
            },
            {
              "lessThan": "9.9.1P18",
              "status": "affected",
              "version": "9.9.1",
              "versionType": "patch"
            },
            {
              "lessThan": "9.10.1P16",
              "status": "affected",
              "version": "9.10.1",
              "versionType": "patch"
            },
            {
              "lessThan": "9.11.1P13",
              "status": "affected",
              "version": "9.11.1",
              "versionType": "patch"
            },
            {
              "lessThan": "9.12.1P8",
              "status": "affected",
              "version": "9.12.1",
              "versionType": "patch"
            },
            {
              "lessThan": "9.13.1P4",
              "status": "affected",
              "version": "9.13.1",
              "versionType": "patch"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ONTAP versions 9.4 and higher are susceptible to a vulnerability \nwhich when successfully exploited could lead to disclosure of sensitive \ninformation to unprivileged attackers when the object-store profiler \ncommand is being run by an administrative user.\n\n"
            }
          ],
          "value": "ONTAP versions 9.4 and higher are susceptible to a vulnerability \nwhich when successfully exploited could lead to disclosure of sensitive \ninformation to unprivileged attackers when the object-store profiler \ncommand is being run by an administrative user.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "201",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-11T23:32:14.386Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/ntap-20240111-0001/"
        }
      ],
      "source": {
        "advisory": "NTAP-20240111-0001",
        "discovery": "UNKNOWN"
      },
      "title": " CVE-2024-21982 Information Disclosure Vulnerability in ONTAP 9 ",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Avoid use of the advanced privilege object-store profiler command to test object store connections on unfixed versions of ONTAP.\n\n"
            }
          ],
          "value": "Avoid use of the advanced privilege object-store profiler command to test object store connections on unfixed versions of ONTAP.\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2024-21982",
    "datePublished": "2024-01-11T23:32:14.386Z",
    "dateReserved": "2024-01-03T19:45:25.345Z",
    "dateUpdated": "2025-06-16T19:48:30.010Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-27317 (GCVE-0-2023-27317)

Vulnerability from cvelistv5 – Published: 2023-12-15 22:59 – Updated: 2025-05-07 20:42
VLAI?
Title
Information Disclosure Vulnerability in ONTAP 9
Summary
ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a vulnerability which will cause all SAS-attached FIPS 140-2 drives to become unlocked after a system reboot or power cycle or a single SAS-attached FIPS 140-2 drive to become unlocked after reinsertion. This could lead to disclosure of sensitive information to an attacker with physical access to the unlocked drives.
CWE
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
Impacted products
Vendor Product Version
NetApp ONTAP 9 Affected: 9.12.1P8
Affected: 9.13.1P4
Affected: 9.13.1P5
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:09:43.287Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20231215-0001/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/NTAP-20231215-0001/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-27317",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T20:42:30.307519Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T20:42:38.376Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ONTAP 9",
          "vendor": "NetApp",
          "versions": [
            {
              "status": "affected",
              "version": "9.12.1P8"
            },
            {
              "status": "affected",
              "version": "9.13.1P4"
            },
            {
              "status": "affected",
              "version": "9.13.1P5"
            }
          ]
        }
      ],
      "datePublic": "2023-12-15T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\nONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a \nvulnerability which will cause all SAS-attached FIPS 140-2 drives to \nbecome unlocked after a system reboot or power cycle or a single \nSAS-attached FIPS 140-2 drive to become unlocked after reinsertion. This\n could lead to disclosure of sensitive information to an attacker with \nphysical access to the unlocked drives. \n\n"
            }
          ],
          "value": "ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a \nvulnerability which will cause all SAS-attached FIPS 140-2 drives to \nbecome unlocked after a system reboot or power cycle or a single \nSAS-attached FIPS 140-2 drive to become unlocked after reinsertion. This\n could lead to disclosure of sensitive information to an attacker with \nphysical access to the unlocked drives. \n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-15T22:59:11.093Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/NTAP-20231215-0001/"
        }
      ],
      "source": {
        "advisory": "NTAP-20231215-0001",
        "discovery": "UNKNOWN"
      },
      "title": "Information Disclosure Vulnerability in ONTAP 9 ",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2023-27317",
    "datePublished": "2023-12-15T22:59:11.093Z",
    "dateReserved": "2023-02-28T17:20:57.462Z",
    "dateUpdated": "2025-05-07T20:42:38.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-27314 (GCVE-0-2023-27314)

Vulnerability from cvelistv5 – Published: 2023-10-12 18:26 – Updated: 2024-09-18 15:02
VLAI?
Title
Denial of Service Vulnerability in ONTAP 9
Summary
ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to cause a crash of the HTTP service.
CWE
  • CWE-400 - Uncontrolled Resource Consumption
Assigner
Impacted products
Vendor Product Version
NetApp ONTAP 9 Affected: 0 , < 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2, 9.13.1 (custom)
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:09:43.031Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231009-0001/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-27314",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-18T15:02:45.835840Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-18T15:02:57.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ONTAP 9",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThan": "9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2, 9.13.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-10-09T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, \n9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow\n a remote unauthenticated attacker to cause a crash of the HTTP service."
            }
          ],
          "value": "ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, \n9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow\n a remote unauthenticated attacker to cause a crash of the HTTP service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-12T18:26:47.593Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/ntap-20231009-0001/"
        }
      ],
      "source": {
        "advisory": "NTAP-20231009-0001",
        "discovery": "UNKNOWN"
      },
      "title": "Denial of Service Vulnerability in ONTAP 9",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2023-27314",
    "datePublished": "2023-10-12T18:26:47.593Z",
    "dateReserved": "2023-02-28T17:20:57.461Z",
    "dateUpdated": "2024-09-18T15:02:57.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}