Lucene search

[email protected]CVE-2018-5488

HistoryJun 13, 2018 - 8:29 p.m.

CVE-2018-5488

2018-06-1320:29:00

CWE-20

[email protected]

web.nvd.nist.gov

netapp

santricity

web services proxy

storage manager

cve-2018-5488

remote code execution

vulnerability

java management extension

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.011 Low

EPSS

Percentile

84.7%

JSON

NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.

Affected configurations

NVD

Node

netappsantricity_storage_managerRange11.30.0x00.0004–11.42.0x00.0001

netappsantricity_web_services_proxyRange1.10.x000.0002–2.12.x000.0002

CPENameOperatorVersion
netapp:santricity_storage_managernetapp santricity storage managerle11.42.0x00.0001
netapp:santricity_web_services_proxynetapp santricity web services proxyle2.12.x000.0002

CPE	Name	Operator	Version
netapp:santricity_storage_manager	netapp santricity storage manager	le	11.42.0x00.0001
netapp:santricity_web_services_proxy	netapp santricity web services proxy	le	2.12.x000.0002

CNA Affected

[
  {
    "product": "SANtricity Products",
    "vendor": "NetApp ",
    "versions": [
      {
        "status": "affected",
        "version": "SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001"
      }
    ]
  }
]

References

www.securityfocus.com/bid/104462

security.netapp.com/advisory/ntap-20180612-0001/

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.011 Low

EPSS

Percentile

84.7%

JSON

Related for CVE-2018-5488

prion1 nvd1 cvelist1 nessus1