CVE-2018-5486

EPSS 0.11%
Published 25.04.2018 21:29:00
Last modified 21.11.2024 04:08:53
Source security-alert@netapp.com
Teams watchlist Login
Open Login

NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauthorized local attackers to execute arbitrary code.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Netapp ≫ Oncommand Unified Manager Version >= 7.2 <= 7.3

Linux ≫ Linux Kernel Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.11%	0.259

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	4.6	3.9	6.4	AV:L/AC:L/Au:N/C:P/I:P/A:P

CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://security.netapp.com/advisory/ntap-20180425-0001/

Vendor Advisory

Mitigation

https://nvd.nist.gov/vuln/detail/CVE-2018-5486

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-5486

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-5486

EUVD