NetApp Security Advisory CVE-2024-21987 Resolved Improper Authorization Vulnerability in SnapCenter

NetApp, Inc. had published a security advisory concerning resolved Improper Authorization Vulnerability in SnapCenter.

This advisory should be considered the single source of current, up-to-date, authorized and accurate information from NetApp regarding Full Support products and versions.

Advisory ID: NTAP-20240216-0001
Version: 1.0
Last updated: 02/16/2024
Status: Final.
CVEs: CVE-2024-21987

Overview

Summary
SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging configuration settings.

Impact
Successful exploitation of this vulnerability could lead to disclosure of sensitive information or addition or modification of data.

Vulnerability scoring details

CVE	Score	Vector
CVE-2024-21987	5.4 (MEDIUM)	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitation and public announcements
NetApp is not aware of public discussion regarding this vulnerability.

Affected products

SnapCenter

Remediation

Software versions and fixes
NetApp’s currently available patches are listed below.

Product	First fixed in release
SnapCenter	https://mysupport.netapp.com/site/products/all/details/snapcenter/downloads-tab/download/62018/5.0

Workarounds
None at this time.

Obtaining software fixes
Software fixes will be made available through the NetApp Support website in the Software Download section.

https://mysupport.netapp.com/site/downloads/

Customers who do not have access to the Support website should contact Technical Support at the number below to obtain the patches.

Contact information
Check http://mysupport.netapp.com for further updates.
For questions, contact NetApp at:

Technical support
mysupport.netapp.com
1 888 4 NETAPP (1 888 463 8277) (U.S. and Canada)
+00 800 44 638277 (EMEA/Europe)
+800 800 80 800 (Asia/Pacific)

Revision History

Status of this notice
Final.
This advisory should be considered the single source of current, up-to-date, authorized and accurate information from NetApp regarding Full Support products and versions.

This advisory is posted at the following link:
https://security.netapp.com/advisory/NTAP-20240216-0001

Revision history

Revision #	Date	Comments
1.0	20240216	Initial public release, final status