CVE-2022-23232

Description

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could allow disabled, expired, or locked external user accounts to access S3 data to which they previously had access. StorageGRID 11.6.0 obtains the user account status from Active Directory or Azure and will block S3 access for disabled user accounts during the subsequent background synchronization. User accounts that are expired or locked for Active Directory or Azure, or user accounts that are disabled, expired, or locked in identity sources other than Active Directory or Azure must be manually removed from group memberships or have their S3 keys manually removed from Tenant Manager in all versions of StorageGRID (formerly StorageGRID Webscale).

4.9

CVSS

Severity: Medium

CVSS 3.1 •

CVSS 2.0 •

EPSS 0.34%

Vendor Advisory netapp.com

Affected: n/a StorageGRID (formerly StorageGRID Webscale)

References

Link	Tags
https://security.netapp.com/advisory/NTAP-20220303-0009/	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2022-23232?: CVE-2022-23232 has been scored as a medium severity vulnerability.
How to fix CVE-2022-23232?: To fix CVE-2022-23232, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-23232 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2022-23232 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-23232?: CVE-2022-23232 affects n/a StorageGRID (formerly StorageGRID Webscale).

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.