Privilege Escalation Vulnerability in ONTAP 9

CVE-2024-21985

Summary

The vulnerability allows authenticated users with multiple remote accounts of differing roles within NetApp's ONTAP system to execute actions through the REST API that go beyond their intended permissions. This misconfiguration can lead to the exposure of limited configuration details and operational metrics, as well as modifications to specific settings. Such unauthorized actions pose a considerable risk, which may result in a Denial of Service (DoS), thereby impacting the availability of services reliant on ONTAP. Entities utilizing affected versions are highly encouraged to evaluate their security posture and apply the necessary patches to mitigate these risks.

References