{"api_version":"1","generated_at":"2026-07-23T11:05:38+00:00","cve":"CVE-2018-5487","urls":{"html":"https://cve.report/CVE-2018-5487","api":"https://cve.report/api/cve/CVE-2018-5487.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-5487","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-5487"},"summary":{"title":"CVE-2018-5487","description":"NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.","state":"PUBLIC","assigner":"security-alert@netapp.com","published_at":"2018-05-24 14:29:00","updated_at":"2018-07-05 13:52:00"},"problem_types":["CWE-20"],"metrics":[],"references":[{"url":"https://security.netapp.com/advisory/ntap-20180523-0001/","name":"https://security.netapp.com/advisory/ntap-20180523-0001/","refsource":"CONFIRM","tags":["Patch","Vendor Advisory"],"title":"CVE-2018-5487 Unauthenticated Remote Code Execution Vulnerability in OnCommand Unified Manager for Linux and Windows 7.2 and above | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-5487","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5487","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"5487","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"5487","vulnerable":"0","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"5487","vulnerable":"1","versionEndIncluding":"7.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"oncommand_unified_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-alert@netapp.com","DATE_PUBLIC":"2018-05-23T00:00:00","ID":"CVE-2018-5487","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"OnCommand Unified Manager for Linux","version":{"version_data":[{"version_value":"Versions 7.2 through 7.3"}]}}]},"vendor_name":"NetApp "}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Remote Code Execution"}]}]},"references":{"reference_data":[{"name":"https://security.netapp.com/advisory/ntap-20180523-0001/","refsource":"CONFIRM","url":"https://security.netapp.com/advisory/ntap-20180523-0001/"}]}},"nvd":{"publishedDate":"2018-05-24 14:29:00","lastModifiedDate":"2018-07-05 13:52:00","problem_types":["CWE-20"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2","versionEndIncluding":"7.3","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","cpe_name":[]}]}],"cpe_match":[]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"5487","Ordinal":"121457","Title":"CVE-2018-5487","CVE":"CVE-2018-5487","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"5487","Ordinal":"1","NoteData":"NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"5487","Ordinal":"2","NoteData":"2018-05-24","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"5487","Ordinal":"3","NoteData":"2018-05-24","Type":"Other","Title":"Modified"}]}}}