CVE-2024-21993 - Vulnerability Details - OpenCVE

SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability
which could allow an authenticated attacker to discover plaintext
credentials.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00087.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Netapp	Snapcenter

Configuration 1 [-]

OR	cpe:2.3:a:netapp:snapcenter::::::::
	cpe:2.3:a:netapp:snapcenter:5.0:-::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-19599	SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability which could allow an authenticated attacker to discover plaintext credentials.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://security.netapp.com/advisory/ntap-20240705-0007/

History

Thu, 27 Mar 2025 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-312
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 22 Nov 2024 15:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:netapp:snapcenter:5.0:-::::::

Tue, 10 Sep 2024 18:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Netapp Netapp snapcenter
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:netapp:snapcenter::::::::
Vendors & Products		Netapp Netapp snapcenter

MITRE

Status: PUBLISHED

Assigner: netapp

Published: 2024-07-09T21:26:03.404Z

Updated: 2025-03-27T15:41:35.222Z

Reserved: 2024-01-03T19:45:25.347Z

Link: CVE-2024-21993

Vulnrichment

Updated: 2024-08-01T22:35:34.687Z

NVD

Status : Modified

Published: 2024-07-09T22:15:01.990

Modified: 2025-03-27T16:15:22.363

Link: CVE-2024-21993

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-21993", "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d", "state": "PUBLISHED", "assignerShortName": "netapp", "dateReserved": "2024-01-03T19:45:25.347Z", "datePublished": "2024-07-09T21:26:03.404Z", "dateUpdated": "2025-03-27T15:41:35.222Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SnapCenter", "vendor": "NetApp", "versions": [{"lessThan": "5.0p1", "status": "affected", "version": "0", "versionType": "patch"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability\n which could allow an authenticated attacker to discover plaintext \ncredentials.\n\n"}], "value": "SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability\n which could allow an authenticated attacker to discover plaintext \ncredentials."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "313", "lang": "en"}]}], "providerMetadata": {"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d", "shortName": "netapp", "dateUpdated": "2024-07-09T21:26:03.404Z"}, "references": [{"url": "https://security.netapp.com/advisory/ntap-20240705-0007/"}], "source": {"advisory": "NTAP-20240705-0007", "discovery": "UNKNOWN"}, "title": "Information Disclosure Vulnerability in SnapCenter", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-312", "lang": "en", "description": "CWE-312 Cleartext Storage of Sensitive Information"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-10T13:20:13.687766Z", "id": "CVE-2024-21993", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-27T15:41:35.222Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.687Z"}, "title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20240705-0007/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20240705-0007/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.687Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-21993", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-10T13:20:13.687766Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-312", "description": "CWE-312 Cleartext Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-11T15:12:46.209Z"}}], "cna": {"title": "Information Disclosure Vulnerability in SnapCenter", "source": {"advisory": "NTAP-20240705-0007", "discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NetApp", "product": "SnapCenter", "versions": [{"status": "affected", "version": "0", "lessThan": "5.0p1", "versionType": "patch"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://security.netapp.com/advisory/ntap-20240705-0007/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability\n which could allow an authenticated attacker to discover plaintext \ncredentials.", "supportingMedia": [{"type": "text/html", "value": "SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability\n which could allow an authenticated attacker to discover plaintext \ncredentials.\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "313"}]}], "providerMetadata": {"orgId": "11fdca00-0482-4c88-a206-37f9c182c87d", "shortName": "netapp", "dateUpdated": "2024-07-09T21:26:03.404Z"}}}, "cveMetadata": {"cveId": "CVE-2024-21993", "state": "PUBLISHED", "dateUpdated": "2025-03-27T15:41:35.222Z", "dateReserved": "2024-01-03T19:45:25.347Z", "assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d", "datePublished": "2024-07-09T21:26:03.404Z", "assignerShortName": "netapp"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netapp:snapcenter:*:*:*:*:*:*:*:*", "matchCriteriaId": "765484BA-3A20-467B-AE57-3BD4190A4100", "versionEndExcluding": "5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:snapcenter:5.0:-:*:*:*:*:*:*", "matchCriteriaId": "3AC68D5C-9F1E-4D62-8A35-D1E71656E308", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability\n which could allow an authenticated attacker to discover plaintext \ncredentials."}, {"lang": "es", "value": "Las versiones de SnapCenter anteriores a la 5.0p1 son susceptibles a una vulnerabilidad que podr\u00eda permitir a un atacante autenticado descubrir credenciales en texto plano."}], "id": "CVE-2024-21993", "lastModified": "2025-03-27T16:15:22.363", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "security-alert@netapp.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-07-09T22:15:01.990", "references": [{"source": "security-alert@netapp.com", "tags": ["Vendor Advisory"], "url": "https://security.netapp.com/advisory/ntap-20240705-0007/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://security.netapp.com/advisory/ntap-20240705-0007/"}], "sourceIdentifier": "security-alert@netapp.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-312"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}