Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 1 vendor · 1 advisory

CVE-2024-21140

CVE-2024-21140: 1 tracked advisory record across NetApp. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

NetApp

1 advisory
  • Advisory severityHigh7.4

    High [CVE-2024-21131 +4] July 2024 Java Platform Standard Edition Vulnerabilities in NetApp Products

    NTAP-20240719-0008Source published Source updated

    This bulletin covers 5 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    Multiple NetApp products incorporate the Oracle Java Platform, Standard Edition (Java SE) software libraries. Certain Java SE (JDK and JRE) versions are susceptible to vulnerabilities that could be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. Refer to “Oracle Critical Patch Update Advisory - July 2024” for specific version details. Successful exploitation of these vulnerabilities could result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Active IQ Unified Manager for VMware vSphere: Only version 9.14 is affected. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. Affected products named by the…

    Affected products in this advisory
    • Active IQ Unified Manager for VMware vSphere
    • Data Infrastructure Insights and Data Secure Storage Workload Security Agent
    • NetApp Console Agent
    • NetApp HCI Compute Node (Bootstrap OS)

    2 more entries in the full advisory.

    Source-reported affected versions
    • 9.14
    Source-reported fixed versions
    • Active IQ Unified Manager for VMware vSphere: 9.16P2
    • NetApp Console Agent: 3.9.41
    • OnCommand Workflow Automation: 5.1.1P7
    Mitigation guidance
    • Update affected NetApp products to a fixed release: Active IQ Unified Manager for VMware vSphere: 9.16P2, NetApp Console Agent: 3.9.41, OnCommand Workflow Automation: 5.1.1P7.
    • Data Infrastructure Insights and Data Secure Storage Workload Security Agent: Fixed in 202409 release.
    • NetApp HCI Compute Node (Bootstrap OS) has no planned fix; migrate to a supported release or product and consult NetApp's end-of-support notice.
    Workarounds
    • <p> If a product requires JRE but does not include it, please update JRE to a fixed version that aligns with the product requirements. <br><br> <a href="https://kb.netapp.com/Advice_and_Troubleshooting/Data_Infrastructure_Management/E-Series_SANtricity_Management_Software/How_to_update_the_Java_Runtime_Environment_(JRE)__Storage_Manager_11.10_or_later" target="_blank">Updating the Java Runtime Environment (JRE) used by SANtricity Storage Manager 11.10 or later </a> <br><br> In Full Support versions of OnCommand Workflow Automation and Active IQ Unified Manager for Linux & Windows the Java software can be upgraded as specified in the product documentation. For assistance with upgrade issues please consult technical support. <br><br> In Full Support versions of OnCommand Insight the Java software can be upgraded. For assistance with the upgrade and access to the updated OnCommand Insight binaries please consult technical support. <br><br> </p>
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future NetApp CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features