CVE-2018-5486

EPSS 0.11%
Veröffentlicht 25.04.2018 21:29:00
Zuletzt bearbeitet 21.11.2024 04:08:53
Quelle security-alert@netapp.com
Teams Watchlist Login
Unerledigt Login

NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauthorized local attackers to execute arbitrary code.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Netapp ≫ Oncommand Unified Manager Version >= 7.2 <= 7.3

Linux ≫ Linux Kernel Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.11%	0.259

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	4.6	3.9	6.4	AV:L/AC:L/Au:N/C:P/I:P/A:P

CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://security.netapp.com/advisory/ntap-20180425-0001/

Vendor Advisory

Mitigation

https://nvd.nist.gov/vuln/detail/CVE-2018-5486

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-5486

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-5486

EUVD