CVE-2018-5486

Published: Apr 25, 2018Modified: Jun 17, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauthorized local attackers to execute arbitrary code.

Affected (1)

Products: Netapp: Oncommand Unified Manager

Netapp

1 product

Oncommand Unified Manager

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Oncommand Unified Manager	From 7.2 to 7.3

Running on/with	Platform Versions
Linux Linux Kernel	All versions

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://security.netapp.com/advisory/ntap-20180425-0001/

Source: security-alert@netapp.com

MitigationVendor Advisory

https://security.netapp.com/advisory/ntap-20180425-0001/

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

Timeline

No history available yet.