CVE-2023-27317 - CVE House
Back to Database
Status published Medium CVE-2023-27317

Information Disclosure Vulnerability in ONTAP 9

Vulnerability Description

ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a vulnerability which will cause all SAS-attached FIPS 140-2 drives to become unlocked after a system reboot or power cycle or a single SAS-attached FIPS 140-2 drive to become unlocked after reinsertion. This could lead to disclosure of sensitive information to an attacker with physical access to the unlocked drives.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-27317

Credits & Attribution

No credits recorded in the NVD database.

References

More from NetApp

View All →
CVE-2025-26517
CVE-2025-26517 Privilege Escalation Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Medium 5.4
CVE-2025-26516
CVE-2025-26516 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Medium 5.3
CVE-2025-26515
CVE-2025-26515 Server-Side Request Forgery Vulnerability in StorageGRID (formerly StorageGRID Webscale)
High 7.5
CVE-2025-26514
CVE-2025-26514 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Medium 6.4
CVE-2025-26513
The installer for SAN Host Utilities for Windows versions prior...
High 7

Affected Vendor

Affected Software

ONTAP 9
Vulnerable Versions:
9.12.1P8, 9.13.1P4, 9.13.1P5

Timeline

Official Publish: December 15th, 2023
Last Modified: May 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration