Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner

Sources

Sort by

Order

CERTFR-2026-AVI-0180

Vulnerability from certfr_avis - Published: 2026-02-18 - Updated: 2026-02-18

Une vulnérabilité a été découverte dans NetApp StorageGRID. Elle permet à un attaquant de provoquer un déni de service à distance, une atteinte à l'intégrité des données et une falsification de requêtes côté serveur (SSRF).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	NetApp	StorageGRID	StorageGRID versions 12.x antérieures à 12.0.0.4
	NetApp	StorageGRID	StorageGRID versions antérieures à 11.9.0.12

References

Title

Publication Time

Tags

Bulletin de sécurité NetApp NTAP-20260217-0001

2026-02-17

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "StorageGRID versions 12.x ant\u00e9rieures \u00e0 12.0.0.4",
      "product": {
        "name": "StorageGRID",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "StorageGRID versions ant\u00e9rieures \u00e0 11.9.0.12",
      "product": {
        "name": "StorageGRID",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-22048",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22048"
    }
  ],
  "initial_release_date": "2026-02-18T00:00:00",
  "last_revision_date": "2026-02-18T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0180",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-02-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans NetApp StorageGRID. Elle permet \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF).",
  "title": "Vuln\u00e9rabilit\u00e9 dans NetApp StorageGRID",
  "vendor_advisories": [
    {
      "published_at": "2026-02-17",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20260217-0001",
      "url": "https://security.netapp.com/advisory/NTAP-20260217-0001"
    }
  ]
}

CERTFR-2024-AVI-0959

Vulnerability from certfr_avis - Published: 2024-11-12 - Updated: 2024-11-12

De multiples vulnérabilités ont été découvertes dans les produits NetApp. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	NetApp	OnCommand Insight	OnCommand Insight versions antérieures à 7.3.16
	NetApp	StorageGRID	StorageGRID (anciennement StorageGRID Webscale) versions antérieures à 11.9.0

References

Title

Publication Time

Tags

Bulletin de sécurité NetApp NTAP-20241108-0001	2024-11-08	vendor-advisory
Bulletin de sécurité NetApp NTAP-20241108-0002	2024-11-08	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OnCommand Insight versions ant\u00e9rieures \u00e0 7.3.16",
      "product": {
        "name": "OnCommand Insight",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "StorageGRID (anciennement StorageGRID Webscale) versions ant\u00e9rieures \u00e0 11.9.0",
      "product": {
        "name": "StorageGRID",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-20919",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20919"
    },
    {
      "name": "CVE-2022-31129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31129"
    },
    {
      "name": "CVE-2017-20189",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-20189"
    },
    {
      "name": "CVE-2010-4756",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-4756"
    },
    {
      "name": "CVE-2024-20926",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20926"
    },
    {
      "name": "CVE-2022-3715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3715"
    },
    {
      "name": "CVE-2024-20921",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20921"
    },
    {
      "name": "CVE-2024-21994",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21994"
    },
    {
      "name": "CVE-2023-5363",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5363"
    },
    {
      "name": "CVE-2023-22081",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22081"
    },
    {
      "name": "CVE-2024-25041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25041"
    },
    {
      "name": "CVE-2023-38552",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38552"
    },
    {
      "name": "CVE-2021-23358",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23358"
    },
    {
      "name": "CVE-2023-22067",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22067"
    },
    {
      "name": "CVE-2024-21634",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21634"
    },
    {
      "name": "CVE-2023-46750",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46750"
    },
    {
      "name": "CVE-2023-46749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46749"
    },
    {
      "name": "CVE-2021-36770",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36770"
    },
    {
      "name": "CVE-2022-24785",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24785"
    },
    {
      "name": "CVE-2023-37466",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37466"
    },
    {
      "name": "CVE-2023-51775",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51775"
    },
    {
      "name": "CVE-2023-37903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37903"
    },
    {
      "name": "CVE-2023-33850",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33850"
    },
    {
      "name": "CVE-2021-20086",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-20086"
    },
    {
      "name": "CVE-2017-20162",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-20162"
    },
    {
      "name": "CVE-2023-44483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44483"
    },
    {
      "name": "CVE-2023-5676",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5676"
    },
    {
      "name": "CVE-2023-24998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-24998"
    },
    {
      "name": "CVE-2024-20918",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20918"
    },
    {
      "name": "CVE-2018-9466",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-9466"
    },
    {
      "name": "CVE-2023-2976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2976"
    },
    {
      "name": "CVE-2024-25053",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25053"
    },
    {
      "name": "CVE-2023-39331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39331"
    },
    {
      "name": "CVE-2024-20945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20945"
    },
    {
      "name": "CVE-2021-3377",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3377"
    },
    {
      "name": "CVE-2023-39332",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39332"
    },
    {
      "name": "CVE-2023-39333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39333"
    },
    {
      "name": "CVE-2023-26159",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26159"
    },
    {
      "name": "CVE-2024-20952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20952"
    }
  ],
  "initial_release_date": "2024-11-12T00:00:00",
  "last_revision_date": "2024-11-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0959",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-11-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits NetApp. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits NetApp",
  "vendor_advisories": [
    {
      "published_at": "2024-11-08",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20241108-0001",
      "url": "https://security.netapp.com/advisory/ntap-20241108-0001/"
    },
    {
      "published_at": "2024-11-08",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20241108-0002",
      "url": "https://security.netapp.com/advisory/ntap-20241108-0002/"
    }
  ]
}

CERTFR-2024-AVI-0825

Vulnerability from certfr_avis - Published: 2024-10-01 - Updated: 2024-10-01

Une vulnérabilité a été découverte dans NetApp StorageGRID. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et un déni de service.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	NetApp	StorageGRID	StorageGRID versions antérieures à 11.8.0.7

References

Title

Publication Time

Tags

Bulletin de sécurité NetApp NTAP-20240905-0001

2024-09-30

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "StorageGRID versions ant\u00e9rieures \u00e0 11.8.0.7",
      "product": {
        "name": "StorageGRID",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-38517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38517"
    }
  ],
  "initial_release_date": "2024-10-01T00:00:00",
  "last_revision_date": "2024-10-01T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0825",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-10-01T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans NetApp StorageGRID. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
  "title": "Vuln\u00e9rabilit\u00e9 dans NetApp StorageGRID",
  "vendor_advisories": [
    {
      "published_at": "2024-09-30",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20240905-0001",
      "url": "https://security.netapp.com/advisory/ntap-20240905-0001/"
    }
  ]
}

CERTFR-2024-AVI-0499

Vulnerability from certfr_avis - Published: 2024-06-17 - Updated: 2024-06-17

Une vulnérabilité a été découverte dans les produits NetApp. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	NetApp	StorageGRID	StorageGRID versions 11.8.x.x antérieures à 11.8.0.5
	NetApp	StorageGRID	StorageGRID versions 11.7.x.x antérieures à 11.7.0.9

References

Title

Publication Time

Tags

Bulletin de sécurité NetApp NTAP-20240614-0010

2024-06-14

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "StorageGRID versions 11.8.x.x ant\u00e9rieures \u00e0 11.8.0.5",
      "product": {
        "name": "StorageGRID",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "StorageGRID versions 11.7.x.x ant\u00e9rieures \u00e0 11.7.0.9",
      "product": {
        "name": "StorageGRID",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-21988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21988"
    }
  ],
  "initial_release_date": "2024-06-17T00:00:00",
  "last_revision_date": "2024-06-17T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0499",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-06-17T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits NetApp. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Vuln\u00e9rabilit\u00e9 dans NetApp StorageGRID",
  "vendor_advisories": [
    {
      "published_at": "2024-06-14",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20240614-0010",
      "url": "https://security.netapp.com/advisory/ntap-20240614-0010/"
    }
  ]
}

CERTFR-2024-AVI-0244

Vulnerability from certfr_avis - Published: 2024-03-25 - Updated: 2024-03-25

De multiples vulnérabilités ont été découvertes dans les produits Netapp. Elles permettent à un attaquant de provoquer un déni de service à distance et une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	NetApp	StorageGRID	StorageGRID (anciennement StorageGRID Webscale) versions antérieures à 11.7.0.8

References

Title

Publication Time

Tags

Bulletin de sécurité Netapp ntap-20240216-0013 du 22 mars 2024	None	vendor-advisory
Bulletin de sécurité Netapp ntap-20240216-0012 du 22 mars 2024	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "StorageGRID (anciennement StorageGRID Webscale) versions ant\u00e9rieures \u00e0 11.7.0.8",
      "product": {
        "name": "StorageGRID",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-21984",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21984"
    },
    {
      "name": "CVE-2024-21983",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21983"
    }
  ],
  "initial_release_date": "2024-03-25T00:00:00",
  "last_revision_date": "2024-03-25T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0244",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-03-25T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nNetapp. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service\n\u00e0 distance et une injection de code indirecte \u00e0 distance (XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Netapp",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Netapp ntap-20240216-0013 du 22 mars 2024",
      "url": "https://security.netapp.com/advisory/ntap-20240216-0013/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Netapp ntap-20240216-0012 du 22 mars 2024",
      "url": "https://security.netapp.com/advisory/ntap-20240216-0012/"
    }
  ]
}

CERTFR-2024-AVI-0093

Vulnerability from certfr_avis - Published: 2024-02-05 - Updated: 2024-02-05

Une vulnérabilité a été découverte dans NetApp StorageGRID. Elle permet à un attaquant de provoquer un déni de service à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	NetApp	StorageGRID	NetApp StorageGRID versions antérieures à 11.6.0.14

References

Title

Publication Time

Tags

Bulletin de sécurité NetApp NTAP-20240202-0012

2024-02-02

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NetApp StorageGRID versions ant\u00e9rieures \u00e0 11.6.0.14",
      "product": {
        "name": "StorageGRID",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-27318",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27318"
    }
  ],
  "initial_release_date": "2024-02-05T00:00:00",
  "last_revision_date": "2024-02-05T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0093",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-02-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans\u00a0\u003cspan class=\"textit\"\u003e NetApp\nStorageGRID\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer un d\u00e9ni de\nservice \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans NetApp StorageGRID",
  "vendor_advisories": [
    {
      "published_at": "2024-02-02",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20240202-0012",
      "url": "https://security.netapp.com/advisory/ntap-20240202-0012/"
    }
  ]
}

CERTFR-2021-AVI-975

Vulnerability from certfr_avis - Published: 2021-12-22 - Updated: 2021-12-22

Une vulnérabilité a été découverte dans NetApp StorageGRID. Elle permet à un attaquant de provoquer une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	NetApp	StorageGRID	StorageGRID (anciennement StorageGRID Webscale) versions antérieures à 11.5.0.5

References

Title

Publication Time

Tags

Bulletin de sécurité NetApp ntap-20211221-0001 du 21 décembre 2021

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "StorageGRID (anciennement StorageGRID Webscale) versions ant\u00e9rieures \u00e0 11.5.0.5",
      "product": {
        "name": "StorageGRID",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-27006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27006"
    }
  ],
  "initial_release_date": "2021-12-22T00:00:00",
  "last_revision_date": "2021-12-22T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-975",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-12-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans NetApp StorageGRID. Elle permet\n\u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans NetApp StorageGRID",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp ntap-20211221-0001 du 21 d\u00e9cembre 2021",
      "url": "https://security.netapp.com/advisory/ntap-20211221-0001/"
    }
  ]
}

CVE-2025-26517 (GCVE-0-2025-26517)

Vulnerability from cvelistv5 – Published: 2025-09-19 18:53 – Updated: 2025-09-19 19:07

Title

CVE-2025-26517 Privilege Escalation Vulnerability in StorageGRID (formerly StorageGRID Webscale)

Summary

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a privilege escalation vulnerability. Successful exploit could allow an unauthorized authenticated attacker to discover Grid node names and IP addresses or modify Storage Grades.

Severity ?

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-266 - Incorrect Privilege Assignment

Assigner

netapp

References

URL

Tags

https://security.netapp.com/advisory/NTAP-20250910-0004

Impacted products

	Vendor	Product	Version
	NetApp	StorageGRID	Affected: 0 , < 11.8.0.15 (custom) Affected: 0 , < 11.9.0.8 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26517",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-19T19:07:15.855472Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-19T19:07:36.019Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "StorageGRID",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThan": "11.8.0.15",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "11.9.0.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003e\n\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eStorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a privilege escalation vulnerability. Successful exploit \ncould allow an unauthorized authenticated attacker to discover Grid node\n names and IP addresses or modify Storage Grades. \u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "StorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a privilege escalation vulnerability. Successful exploit \ncould allow an unauthorized authenticated attacker to discover Grid node\n names and IP addresses or modify Storage Grades."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "CWE-266 Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-19T18:53:07.531Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/NTAP-20250910-0004"
        }
      ],
      "source": {
        "advisory": "NTAP-20250910-0004",
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2025-26517 Privilege Escalation Vulnerability in StorageGRID (formerly StorageGRID Webscale)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2025-26517",
    "datePublished": "2025-09-19T18:53:07.531Z",
    "dateReserved": "2025-02-11T21:58:04.395Z",
    "dateUpdated": "2025-09-19T19:07:36.019Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-26516 (GCVE-0-2025-26516)

Vulnerability from cvelistv5 – Published: 2025-09-19 18:51 – Updated: 2025-09-19 19:06

Title

CVE-2025-26516 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)

Summary

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Denial of Service vulnerability. Successful exploit could allow an unauthenticated attacker to cause a Denial of Service on the Admin node.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-405 - Asymmetric Resource Consumption (Amplification)

Assigner

netapp

References

URL

Tags

https://security.netapp.com/advisory/NTAP-20250910-0003

Impacted products

	Vendor	Product	Version
	NetApp	StorageGRID	Affected: 0 , < 11.8.0.15 (custom) Affected: 0 , < 11.9.0.8 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26516",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-19T19:06:15.932920Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-19T19:06:24.828Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "StorageGRID",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThan": "11.8.0.15",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "11.9.0.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eStorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a Denial of Service vulnerability. Successful exploit \ncould allow an unauthenticated attacker to cause a Denial of Service on \nthe Admin node.\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "StorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a Denial of Service vulnerability. Successful exploit \ncould allow an unauthenticated attacker to cause a Denial of Service on \nthe Admin node."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-405",
              "description": "CWE-405 Asymmetric Resource Consumption (Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-19T18:51:12.609Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/NTAP-20250910-0003"
        }
      ],
      "source": {
        "advisory": "NTAP-20250910-0003",
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2025-26516 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2025-26516",
    "datePublished": "2025-09-19T18:51:12.609Z",
    "dateReserved": "2025-02-11T21:58:04.395Z",
    "dateUpdated": "2025-09-19T19:06:24.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-26515 (GCVE-0-2025-26515)

Vulnerability from cvelistv5 – Published: 2025-09-19 18:34 – Updated: 2025-09-19 18:46

Title

CVE-2025-26515 Server-Side Request Forgery Vulnerability in StorageGRID (formerly StorageGRID Webscale)

Summary

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without Single Sign-on enabled are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an unauthenticated attacker to change the password of any Grid Manager or Tenant Manager non-federated user.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

netapp

References

URL

Tags

https://security.netapp.com/advisory/NTAP-20250910-0002

Impacted products

	Vendor	Product	Version
	NetApp	StorageGRID	Affected: 0 , < 11.8.0.15 (custom) Affected: 0 , < 11.9.0.8 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26515",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-19T18:46:25.909641Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-19T18:46:37.919Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "StorageGRID",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThan": "11.8.0.15",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "11.9.0.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003e\n\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003e\n\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eStorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without \nSingle Sign-on enabled are susceptible to a Server-Side Request Forgery \n(SSRF) vulnerability. Successful exploit could allow an unauthenticated \nattacker to change the password of any Grid Manager or Tenant Manager \nnon-federated user.\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "StorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without \nSingle Sign-on enabled are susceptible to a Server-Side Request Forgery \n(SSRF) vulnerability. Successful exploit could allow an unauthenticated \nattacker to change the password of any Grid Manager or Tenant Manager \nnon-federated user."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-19T18:34:17.283Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/NTAP-20250910-0002"
        }
      ],
      "source": {
        "advisory": "NTAP-20250910-0002",
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2025-26515 Server-Side Request Forgery Vulnerability in StorageGRID (formerly StorageGRID Webscale)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2025-26515",
    "datePublished": "2025-09-19T18:34:17.283Z",
    "dateReserved": "2025-02-11T21:58:04.395Z",
    "dateUpdated": "2025-09-19T18:46:37.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-26514 (GCVE-0-2025-26514)

Vulnerability from cvelistv5 – Published: 2025-09-19 18:31 – Updated: 2025-09-19 18:49

Title

CVE-2025-26514 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)

Summary

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Reflected Cross-Site Scripting vulnerability. Successful exploit could allow an attacker to view or modify configuration settings or add or modify user accounts but requires the attacker to know specific information about the target instance and then trick a privileged user into clicking a specially crafted link.

Severity ?

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

netapp

References

URL

Tags

https://security.netapp.com/advisory/NTAP-20250910-0001

Impacted products

	Vendor	Product	Version
	NetApp	StorageGRID	Affected: 0 , < 11.8.0.15 (custom) Affected: 0 , < 11.9.0.8 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26514",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-19T18:49:45.652444Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-19T18:49:58.274Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "StorageGRID",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThan": "11.8.0.15",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "11.9.0.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003e\n\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eStorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a Reflected Cross-Site Scripting vulnerability. \nSuccessful exploit could allow an attacker to view or modify \nconfiguration settings or add or modify user accounts but requires the \nattacker to know specific information about the target instance and then\n trick a privileged user into clicking a specially crafted link.\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "StorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a Reflected Cross-Site Scripting vulnerability. \nSuccessful exploit could allow an attacker to view or modify \nconfiguration settings or add or modify user accounts but requires the \nattacker to know specific information about the target instance and then\n trick a privileged user into clicking a specially crafted link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-19T18:31:54.948Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/NTAP-20250910-0001"
        }
      ],
      "source": {
        "advisory": "NTAP-20250910-0001",
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2025-26514 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2025-26514",
    "datePublished": "2025-09-19T18:31:54.948Z",
    "dateReserved": "2025-02-11T21:58:04.395Z",
    "dateUpdated": "2025-09-19T18:49:58.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-21994 (GCVE-0-2024-21994)

Vulnerability from cvelistv5 – Published: 2024-11-08 21:06 – Updated: 2024-11-09 15:52

Title

CVE-2024-21994 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)

Summary

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authenticated attacker could lead to a service crash.

Severity ?

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE

789

Assigner

netapp

References

URL

Tags

https://security.netapp.com/advisory/ntap-2024110…

Impacted products

	Vendor	Product	Version
	NetApp	StorageGRID	Affected: 0 , < 11.9.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21994",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-09T15:52:45.627489Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-09T15:52:48.138Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "StorageGRID",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThan": "11.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStorageGRID (formerly StorageGRID Webscale) versions prior to 11.9 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authenticated attacker could lead to a service crash.\u003c/p\u003e"
            }
          ],
          "value": "StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authenticated attacker could lead to a service crash."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "789",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-08T21:06:32.380Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/ntap-20241108-0001/"
        }
      ],
      "source": {
        "advisory": "NTAP-20241108-0001",
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2024-21994 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2024-21994",
    "datePublished": "2024-11-08T21:06:32.380Z",
    "dateReserved": "2024-01-03T19:45:25.347Z",
    "dateUpdated": "2024-11-09T15:52:48.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-21984 (GCVE-0-2024-21984)

Vulnerability from cvelistv5 – Published: 2024-02-16 22:37 – Updated: 2025-04-24 15:11

Title

Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)

Summary

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 are susceptible to a difficult to exploit Reflected Cross-Site Scripting (XSS) vulnerability. Successful exploit requires the attacker to know specific information about the target instance and trick a privileged user into clicking a specially crafted link. This could allow the attacker to view or modify configuration settings or add or modify user accounts.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

CWE

CWE-79

Assigner

netapp

References

URL

Tags

https://security.netapp.com/advisory/ntap-2024021…

Impacted products

	Vendor	Product	Version
	NetApp	StorageGRID	Affected: 0 , < 11.8 (general availability)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21984",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-20T15:11:36.367921Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-24T15:11:36.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:35:34.659Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240216-0013/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "StorageGRID",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThan": "11.8",
              "status": "affected",
              "version": "0",
              "versionType": "general availability"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 \nare susceptible to a difficult to exploit Reflected Cross-Site Scripting\n (XSS) vulnerability. Successful exploit requires the attacker to know \nspecific information about the target instance and trick a privileged \nuser into clicking a specially crafted link. This could allow the \nattacker to view or modify configuration settings or add or modify user \naccounts. \n\n\n\n\n"
            }
          ],
          "value": "StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 \nare susceptible to a difficult to exploit Reflected Cross-Site Scripting\n (XSS) vulnerability. Successful exploit requires the attacker to know \nspecific information about the target instance and trick a privileged \nuser into clicking a specially crafted link. This could allow the \nattacker to view or modify configuration settings or add or modify user \naccounts. \n\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T22:37:47.580Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/ntap-20240216-0013/"
        }
      ],
      "source": {
        "advisory": "NTAP-20240216-0013",
        "discovery": "UNKNOWN"
      },
      "title": "Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2024-21984",
    "datePublished": "2024-02-16T22:37:47.580Z",
    "dateReserved": "2024-01-03T19:45:25.346Z",
    "dateUpdated": "2025-04-24T15:11:36.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-21983 (GCVE-0-2024-21983)

Vulnerability from cvelistv5 – Published: 2024-02-16 22:35 – Updated: 2024-08-01 22:35

Title

Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)

Summary

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authenticated attacker could lead to an out of memory condition or node reboot.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-248

Assigner

netapp

References

URL

Tags

https://security.netapp.com/advisory/ntap-2024021…

Impacted products

	Vendor	Product	Version
	NetApp	StorageGRID	Affected: 0 , < 11.8 (general availability)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21983",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-20T15:30:00.617001Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-07T15:58:32.902Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:35:34.510Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240216-0012/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "StorageGRID",
          "vendor": "NetApp",
          "versions": [
            {
              "lessThan": "11.8",
              "status": "affected",
              "version": "0",
              "versionType": "general availability"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 \nare susceptible to a Denial of Service (DoS) vulnerability. Successful \nexploit by an authenticated attacker could lead to an out of memory \ncondition or node reboot.\n\n"
            }
          ],
          "value": "StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 \nare susceptible to a Denial of Service (DoS) vulnerability. Successful \nexploit by an authenticated attacker could lead to an out of memory \ncondition or node reboot.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T22:35:02.365Z",
        "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
        "shortName": "netapp"
      },
      "references": [
        {
          "url": "https://security.netapp.com/advisory/ntap-20240216-0012/"
        }
      ],
      "source": {
        "advisory": "NTAP-20240216-0012",
        "discovery": "UNKNOWN"
      },
      "title": "Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) ",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d",
    "assignerShortName": "netapp",
    "cveId": "CVE-2024-21983",
    "datePublished": "2024-02-16T22:35:02.365Z",
    "dateReserved": "2024-01-03T19:45:25.346Z",
    "dateUpdated": "2024-08-01T22:35:34.510Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Search criteria

14 vulnerabilities found for StorageGRID by NetApp

CERTFR-2026-AVI-0180

Solutions

CERTFR-2024-AVI-0959

Solutions

CERTFR-2024-AVI-0825

Solutions

CERTFR-2024-AVI-0499

Solutions

CERTFR-2024-AVI-0244

Solution

CERTFR-2024-AVI-0093

Solution

CERTFR-2021-AVI-975

Solution

CVE-2025-26517 (GCVE-0-2025-26517)

CVE-2025-26516 (GCVE-0-2025-26516)

CVE-2025-26515 (GCVE-0-2025-26515)

CVE-2025-26514 (GCVE-0-2025-26514)

CVE-2024-21994 (GCVE-0-2024-21994)

CVE-2024-21984 (GCVE-0-2024-21984)

CVE-2024-21983 (GCVE-0-2024-21983)