CVE-2018-5481

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

OnCommand Unified Manager for 7-Mode (core package) prior to 5.2.4 uses cookies that lack the secure attribute in certain circumstances making it vulnerable to impersonation via man-in-the-middle (MITM) attacks.

Metrics

CVSS 3.0 7.4/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-311

Affected software

Vendor	Product	Versions
NetApp	OnCommand Unified Manager for 7-Mode (core package)	Versions prior to 5.2.4

References

https://security.netapp.com/advisory/ntap-20190104-0001/Vendor Advisory
https://security.netapp.com/advisory/ntap-20190104-0001/Vendor Advisory

Timeline

Published: Jan 7, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-54825.3NetApp SnapCenter Server prior to 4.1 does not set the secure flag for a sensitive cookie in an HTTPS session which can allow the transmissi CVE-2018-54857.8NetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 are susceptible to a vulnerability which could lead to a privilege esc CVE-2018-54867.8NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauth CVE-2018-54879.8NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RM CVE-2018-54889.8NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 1 CVE-2018-54896.5NetApp 7-Mode Transition Tool allows users with valid credentials to access functions and information which may have been intended to be res CVE-2018-54908.8Read-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release Candidate versions and therefore may allow more CVE-2018-54929.8NetApp E-Series SANtricity OS Controller Software 11.30 and later version 11.30.5 is susceptible to unauthenticated remote code execution.CVE-2018-54937.5ATTO FibreBridge 7500N firmware versions prior to 2.90 are susceptible to a vulnerability which allows an unauthenticated remote attacker to CVE-2018-54959.8All StorageGRID Webscale versions are susceptible to a vulnerability which could permit an unauthenticated attacker to communicate with syst CVE-2018-54964.4Data ONTAP operating in 7-Mode versions prior to 8.2.5P2 are susceptible to a vulnerability which discloses sensitive information to an unau CVE-2018-54974.4Clustered Data ONTAP versions prior to 9.1P16, 9.3P10 and 9.4P5 are susceptible to a vulnerability which discloses sensitive information to