Auth bypass in Netapp Oncommand_insight
CVE-2018-1258
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be…
Vulnerability class: Broken Access Control
EPSS: 0.024 (82.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Netapp Oncommand_insight
- Netapp Oncommand_unified_manager
- Netapp Oncommand_workflow_automation
- Netapp Snapcenter
- Netapp Storage_automation_store
- Oracle Agile_plm — versions 9.3.3, 9.3.4, 9.3.5
- Oracle Application_testing_suite — versions 10.1, 12.5.0.3, 13.1.0.1
- Oracle Big_data_discovery — versions 1.6.0
- Oracle Communications_converged_application_server
- Oracle Communications_diameter_signaling_router
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security_alert@emc.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security_alert@emc.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- security_alert@emc.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- security_alert@emc.com (x_refsource_REDHAT, vendor-advisory, Patch, Third Party Advisory)
- security_alert@emc.com (Patch, Third Party Advisory, x_refsource_MISC)
- security_alert@emc.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security_alert@emc.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security_alert@emc.com (Patch, Third Party Advisory, x_refsource_MISC)
- security_alert@emc.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security_alert@emc.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2018-1258?
- CVE-2018-1258 is a high-severity vulnerability in Netapp Oncommand_insight, classified under Incorrect Authorization. CVSS score: 8.8/10. Published 2018-05-11.
- How severe is CVE-2018-1258?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2018-1258 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.