Auth bypass in NetApp 7-Mode Transition Tool
CVE-2018-5489
NetApp 7-Mode Transition Tool allows users with valid credentials to access functions and information which may have been intended to be restricted to administrators or privileged users. 7MTT versions below 2.0 do not enforce user authorization rules on file information and status that it has previously collected. The released version of 7MTT has been updated to maintain and verify authorization rules for file information, status and utilities.
Vulnerability class: Broken Access Control
EPSS: 0.008 (52.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Netapp 7-mode Transition Tool — versions Versions below 2.0
- Netapp 7-mode_transition_tool
Weakness classification (CWE)
References
- security-alert@netapp.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-5489?
- CVE-2018-5489 is a medium-severity vulnerability in NetApp 7-Mode Transition Tool, classified under Incorrect Authorization. CVSS score: 6.5/10. Published 2018-08-03.
- How severe is CVE-2018-5489?
- Medium severity. CVSS v3 base score is 6.5 out of 10.