Vulnerability Details : CVE-2018-5488
NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.
Vulnerability category: Input validationExecute code
Products affected by CVE-2018-5488
- Netapp » Santricity Storage ManagerVersions from including (>=) 11.30.0x00.0004 and up to, including, (<=) 11.42.0x00.0001cpe:2.3:a:netapp:santricity_storage_manager:*:*:*:*:*:*:*:*
- Netapp » Santricity Web Services ProxyVersions from including (>=) 1.10.x000.0002 and up to, including, (<=) 2.12.x000.0002cpe:2.3:a:netapp:santricity_web_services_proxy:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-5488
2.24%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 83 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-5488
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2018-5488
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-5488
-
https://security.netapp.com/advisory/ntap-20180612-0001/
CVE-2018-5488 Unauthenticated Remote Code Execution Vulnerability in SANtricity Products | NetApp Product SecurityVendor Advisory
-
http://www.securityfocus.com/bid/104462
NetApp SANtricity Products CVE-2018-5488 Remote Code Execution VulnerabilityThird Party Advisory;VDB Entry
Jump to