CVE-2018-5488: Input Validation
NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the Java Management Extension Remote Method Invocation (JMX RMI) service so it is not reachable from untrusted networks (e.g., block/allow only trusted management sources at the firewall/ACL).
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-5488.
What is the severity of CVE-2018-5488?
CVE-2018-5488 has a severity rating of 9.8 (Critical).
Which versions of NetApp SANtricity Web Services Proxy are affected by this vulnerability?
NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 are affected by this vulnerability.
Which versions of NetApp SANtricity Storage Manager are affected by this vulnerability?
NetApp SANtricity Storage Manager versions 11.30.0X00.0004 through 11.42.0X00.0001 are affected by this vulnerability.
How can I fix CVE-2018-5488?
To fix CVE-2018-5488, it is recommended to apply the necessary updates or patches provided by NetApp.