CVE-2018-5488

moderate-risk
Published 2018-06-13

NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.

Do I need to act?

~
2.1% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (2)

Santricity Storage Manager
Santricity Web Services Proxy

Affected Vendors

Netapp

References (4)

Third Party Advisory http://www.securityfocus.com/bid/104462
Vendor Advisory https://security.netapp.com/advisory/ntap-20180612-0001/
Third Party Advisory http://www.securityfocus.com/bid/104462
Vendor Advisory https://security.netapp.com/advisory/ntap-20180612-0001/
44
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 5/34 · Minimal
Exposure 7/34 · Low