CVE-2018-5490

{"containers": {"cna": {"affected": [{"product": "Clustered Data ONTAP", "vendor": "NetApp", "versions": [{"status": "affected", "version": "8.3 Release Candidate versions"}]}], "datePublic": "2015-03-24T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Read-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release Candidate versions and therefore may allow more than \"read-only\" access from authenticated SMBv2 and SMBv3 clients. This behavior has been resolved in the GA release. Customers running prior release candidates (RCs) are requested to update their systems to the NetApp Data ONTAP 8.3 GA release."}], "problemTypes": [{"descriptions": [{"description": "Unauthorized Write Access", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-08-03T18:57:01.000Z", "orgId": "11fdca00-0482-4c88-a206-37f9c182c87d", "shortName": "netapp"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://security.netapp.com/advisory/ntap-20150324-0001/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-alert@netapp.com", "DATE_PUBLIC": "2015-03-24T00:00:00", "ID": "CVE-2018-5490", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Clustered Data ONTAP", "version": {"version_data": [{"version_value": "8.3 Release Candidate versions"}]}}]}, "vendor_name": "NetApp"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Read-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release Candidate versions and therefore may allow more than \"read-only\" access from authenticated SMBv2 and SMBv3 clients. This behavior has been resolved in the GA release. Customers running prior release candidates (RCs) are requested to update their systems to the NetApp Data ONTAP 8.3 GA release."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Unauthorized Write Access"}]}]}, "references": {"reference_data": [{"name": "https://security.netapp.com/advisory/ntap-20150324-0001/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20150324-0001/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T05:40:50.508Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://security.netapp.com/advisory/ntap-20150324-0001/"}]}]}, "cveMetadata": {"assignerOrgId": "11fdca00-0482-4c88-a206-37f9c182c87d", "assignerShortName": "netapp", "cveId": "CVE-2018-5490", "datePublished": "2018-08-03T19:00:00.000Z", "dateReserved": "2018-01-12T00:00:00.000Z", "dateUpdated": "2024-09-16T17:22:52.478Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Clustered Data ONTAP", "vendor": "NetApp", "versions": [{"status": "affected", "version": "8.3 Release Candidate versions"}]}], "source": "security-alert@netapp.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*", "matchCriteriaId": "C5B7135A-D914-4D08-8520-E8A8464B6B78", "versionEndExcluding": "8.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Read-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release Candidate versions and therefore may allow more than \"read-only\" access from authenticated SMBv2 and SMBv3 clients. This behavior has been resolved in the GA release. Customers running prior release candidates (RCs) are requested to update their systems to the NetApp Data ONTAP 8.3 GA release."}, {"lang": "es", "value": "Las reglas de pol\u00edtica de exportaci\u00f3n de solo lectura no se aplican correctamente en Clustered Data ONTAP en versiones 8.3 Release Candidate y, por lo tanto, podr\u00edan permitir m\u00e1s que el acceso \"solo lectura\" desde clientes SMBv2 y SMBv3 autenticados. Este comportamiento ha sido resuelto en la versi\u00f3n GA. Se solicita a los clientes que ejecuten RC (release candidates) anteriores que actualicen sus sistemas a la versi\u00f3n 8.3 GA de NetApp Data ONTAP."}], "id": "CVE-2018-5490", "lastModified": "2026-06-17T02:00:24.340", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-08-03T19:29:00.933", "references": [{"source": "security-alert@netapp.com", "tags": ["Vendor Advisory"], "url": "https://security.netapp.com/advisory/ntap-20150324-0001/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://security.netapp.com/advisory/ntap-20150324-0001/"}], "sourceIdentifier": "security-alert@netapp.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}