9.8crit
CVE-2018-5488
NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.8%
percentile 90%
Public exploits
0
none known
Summary
NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.
Exploit prediction (EPSS)
3.78% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- NetApp SANtricity Products
Classification
- Weakness
- CWE-20 Improper Input Validation
References
- securityfocus.com /bid/104462 · vdb-entry, x_refsource_BID, x_transferred
- security.netapp.com /advisory/ntap-20180612-0001/ · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-5488
- NVD: CVE-2018-5488
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.