Medium severity · published Jun 14, 2024
CVE-2024-21988
CVE-2024-21988 SSH Cryptographic Implementation Vulnerability in StorageGRID (formerly StorageGRID Webscale)
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
StorageGRID (formerly StorageGRID Webscale) versions prior to
11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive
information via complex MiTM attacks due to a vulnerability in the SSH
cryptographic implementation.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
StorageGRID (formerly StorageGRID Webscale) · NetApp
before 11.7.0.9; before 11.8.0.5 · source: vendor
ST
Storagegrid · Netapp
before 11.7.0.9; 11.8.0 before 11.8.0.5 · source: NVD
Affected product
SF
StorageGRID (formerly StorageGRID Webscale)
NetApp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21988
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21988
Patch
https://security.netapp.com/advisory/ntap-20240614-0010/
More from StorageGRID (formerly StorageGRID Webscale)
7.5
CVE-2023-27318
Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
7.1
CVE-2026-22048
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (formerly Azure AD) as an…
6.0
CVE-2026-22063
CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products
4.3
CVE-2026-22051
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Disclosure vulnerability