Medium severity · published Aug 3, 2018
CVE-2018-5489
NetApp 7-Mode Transition Tool allows users with valid credentials to access functions and information which may have been intended to be restricted to administrators or privileged…
6.5
CVSS
0.8%
EPSS
No
On KEV
Description
NetApp 7-Mode Transition Tool allows users with valid credentials to access functions and information which may have been intended to be restricted to administrators or privileged users. 7MTT versions below 2.0 do not enforce user authorization rules on file information and status that it has previously collected. The released version of 7MTT has been updated to maintain and verify authorization rules for file information, status and utilities.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
7T
7-Mode Transition Tool · NetApp
Versions below 2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-5489
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-5489
Vendor Advisory
https://security.netapp.com/advisory/ntap-20150323-0001/
More from 7-Mode Transition Tool
9.8
CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
8.1
CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g
8.3
CVE-2020-14664
Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX)
8.3
CVE-2020-14583
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries)
8.3
CVE-2020-2805
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries)
