CVE-2024-21988
Last modified
CVE-2024-21988 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. StorageGRID (formerly StorageGRID Webscale) versions prior to 11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive information via complex MiTM attacks due to a vulnerability in the SSH cryptographic implementation.. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive information via complex MiTM attacks due to a vulnerability in the SSH cryptographic implementation.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Netapp | Storagegrid | < 11.7.0.9 |
| Netapp | Storagegrid | >= 11.8.0, < 11.8.0.5 |
References
- https://security.netapp.com/advisory/ntap-20240614-0010/Patch, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20240614-0010/Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-21988?
How severe is CVE-2024-21988?
How do I fix CVE-2024-21988?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-21981Improper key usage control in AMD Secure Processor (ASP) may…5.7
- CVE-2024-21982ONTAP versions 9.4 and higher are susceptible to a vulnerabi…6.5
- CVE-2024-21983StorageGRID (formerly StorageGRID Webscale) versions prior t…6.5
- CVE-2024-21984StorageGRID (formerly StorageGRID Webscale) versions prior t…6.9
- CVE-2024-21985ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.…7.6
- CVE-2024-21987SnapCenter versions 4.8 prior to 5.0 are susceptible to a v…5.4
- CVE-2024-21989ONTAP Select Deploy administration utility versions 9.12.1.x…8.8
- CVE-2024-2199A denial of service vulnerability was found in 389-ds-base l…5.7
- CVE-2024-21990ONTAP Select Deploy administration utility versions 9.12.1.x…9.8
- CVE-2024-21993SnapCenter versions prior to 5.0p1 are susceptible to a vuln…6.5
- CVE-2024-21994StorageGRID (formerly StorageGRID Webscale) versions prior t…4.3
- CVE-2024-2200The Contact Form by BestWebSoft plugin for WordPress is vuln…6.1
Are you affected by CVE-2024-21988?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST