CVE-2018-1258: netapp oncommand_insight Incorrect Authorization
CVSS: 8.8v3.1HighModified
AliasesGHSA-cxrj-66c5-9fmh
Published 11-05-2018Last modified 17-09-2024
Vulnerability summary
CVE-2018-1258 is a high (CVSS 8.8) Incorrect Authorization vulnerability in netapp oncommand_insight. EPSS estimates a 2.46% chance of exploitation in the next 30 days, higher than 84.1% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
2.46%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 11-05-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
CVSS metrics
3 scores · 2 sources · 3 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
High 8.8Preferred score · OSV · Maven (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
Medium 6.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.46%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
0.00 pp
From 2.46% on 18-09-2026
18-09-202618-10-2026
EPSS score2.46%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Oracle34 products
- agile_product_lifecycle_management9.3.3 | 9.3.4 | 9.3.5 | 9.3.6
- application_testing_suite10.1 | 12.5.0.3 | 13.1.0.1 | 13.2.0.1 | 13.3.0.1
- big_data_discovery1.6.0
- communications_converged_application_server< 7.0.0.1
- communications_diameter_signaling_router< 8.3
Netapp5 products
- oncommand_insightna
- oncommand_unified_manager≥ 7.3 (No fix recorded) | ≥ 9.4 (No fix recorded)
- oncommand_workflow_automationna
- snapcenterna
- storage_automation_storena
Org.springframework1 product
- spring-core≥ 5.0.5.RELEASE, < 5.0.6.RELEASE
Pivotal1 product
- spring framework5.0.5
Redhat1 product
- fuse7.3.0
Vmware1 product
- spring_framework5.0.5
6 vendors · 43 products
References
24 links- access.redhat.com/errata/RHSA-2019:2413Vendor AdvisoryX Refsource REDHATPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCPatchThird Party AdvisoryWEB
Show all 24 references
- www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlX Refsource MISCPatchThird Party AdvisoryWEB
