Netapp Astra Control Center vulnerabilities

3 CVEs affecting Netapp Astra Control Center, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-1351, published 2024-03-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2024-22019, published 2024-02-20. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads…
CVE-2024-1351, published 2024-03-07. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the…