What is CVE-2018-5490?

CVE-2018-5490 is a high-severity vulnerability in Netapp Clustered Data Ontap, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 8.8/10. Published 2018-08-03.

How severe is CVE-2018-5490?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Netapp Clustered Data Ontap

CVE-2018-5490

Read-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release Candidate versions and therefore may allow more than "read-only" access from authenticated SMBv2 and SMBv3 clients. This behavior has been resolved in the GA release. Customers running prior release candidates (RCs) are requested to update their systems to the NetApp Data ONTAP 8.3 GA release.

EPSS: 0.009 (54.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Netapp Clustered Data Ontap — versions 8.3 Release Candidate versions
Netapp Clustered_data_ontap

Weakness classification (CWE)

CWE-732 — Incorrect Permission Assignment for Critical Resource

References

security-alert@netapp.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-5490?: CVE-2018-5490 is a high-severity vulnerability in Netapp Clustered Data Ontap, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 8.8/10. Published 2018-08-03.
How severe is CVE-2018-5490?: High severity. CVSS v3 base score is 8.8 out of 10.