CVE-2021-26988: Low severity ibm network appliance data ontap vulnerability

Published Mar 4, 2021

Updated

Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8 and 9.8 are susceptible to a vulnerability which could allow unauthorized tenant users to discover information related to converting a 7-Mode directory to Cluster-mode such as Storage Virtual Machine (SVM) names, volume names, directory paths and Job IDs.

Affected Software

58 affected components

NetApp Data ONTAP=9.3.0

NetApp Data ONTAP=9.3.0-p1

NetApp Data ONTAP=9.3.0-p10

NetApp Data ONTAP=9.3.0-p11

NetApp Data ONTAP=9.3.0-p12

NetApp Data ONTAP=9.3.0-p13

NetApp Data ONTAP=9.3.0-p14

NetApp Data ONTAP=9.3.0-p15

NetApp Data ONTAP=9.3.0-p16

NetApp Data ONTAP=9.3.0-p17

NetApp Data ONTAP=9.3.0-p18

NetApp Data ONTAP=9.3.0-p19

NetApp Data ONTAP=9.3.0-p2

NetApp Data ONTAP=9.3.0-p20

NetApp Data ONTAP=9.3.0-p3

NetApp Data ONTAP=9.3.0-p4

NetApp Data ONTAP=9.3.0-p5

NetApp Data ONTAP=9.3.0-p6

NetApp Data ONTAP=9.3.0-p7

NetApp Data ONTAP=9.3.0-p8

NetApp Data ONTAP=9.3.0-p9

NetApp Data ONTAP=9.5.0

NetApp Data ONTAP=9.5.0-p1

NetApp Data ONTAP=9.5.0-p10

NetApp Data ONTAP=9.5.0-p11

NetApp Data ONTAP=9.5.0-p12

NetApp Data ONTAP=9.5.0-p13

NetApp Data ONTAP=9.5.0-p14

NetApp Data ONTAP=9.5.0-p15

NetApp Data ONTAP=9.5.0-p2

NetApp Data ONTAP=9.5.0-p3

NetApp Data ONTAP=9.5.0-p4

NetApp Data ONTAP=9.5.0-p5

NetApp Data ONTAP=9.5.0-p6

NetApp Data ONTAP=9.5.0-p7

NetApp Data ONTAP=9.5.0-p8

NetApp Data ONTAP=9.5.0-p9

NetApp Data ONTAP=9.6.0

NetApp Data ONTAP=9.6.0-p1

NetApp Data ONTAP=9.6.0-p10

NetApp Data ONTAP=9.6.0-p11

NetApp Data ONTAP=9.6.0-p2

NetApp Data ONTAP=9.6.0-p3

NetApp Data ONTAP=9.6.0-p4

NetApp Data ONTAP=9.6.0-p5

NetApp Data ONTAP=9.6.0-p6

NetApp Data ONTAP=9.6.0-p7

NetApp Data ONTAP=9.6.0-p8

NetApp Data ONTAP=9.6.0-p9

NetApp Data ONTAP=9.7.0

NetApp Data ONTAP=9.7.0-p1

NetApp Data ONTAP=9.7.0-p2

NetApp Data ONTAP=9.7.0-p3

NetApp Data ONTAP=9.7.0-p4

NetApp Data ONTAP=9.7.0-p5

NetApp Data ONTAP=9.7.0-p6

NetApp Data ONTAP=9.7.0-p7

NetApp Data ONTAP=9.8.0

Remediation

Patch Available

https://security.netapp.com/advisory/NTAP-20210303-0001

Event History

Mar 4, 2021

CVE Published

via MITRE·08:44 PM

Data Sourced

via MITRE·08:44 PM

DescriptionWeakness

Frequently Asked Questions

What versions of Clustered Data ONTAP are susceptible to CVE-2021-26988?

Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8, and 9.8 are susceptible.

What is the severity of CVE-2021-26988?

The severity of CVE-2021-26988 is rated as low with a CVSS score of 3.5.

How can unauthorized tenant users exploit CVE-2021-26988?

Unauthorized tenant users could exploit this vulnerability to discover information related to converting a 7-Mode directory to Cluster-mode.

Is there a fix available for CVE-2021-26988?

Updating Clustered Data ONTAP to versions 9.3P21, 9.5P16, 9.6P12, 9.7P8, or 9.8 addresses this vulnerability.

Where can I find more information about CVE-2021-26988?

You can refer to the advisory provided by NetApp at the following link: https://security.netapp.com/advisory/NTAP-20210303-0001.