Read the docs
TI-2018-03996 Aliases CVE-2018-5489GHSA-2g6x-rfgr-7f5j

Incorrect authorization in NetApp 7-Mode Transition Tool

Priority LOW 30CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

NetApp 7-Mode Transition Tool allows users with valid credentials to access functions and information which may have been intended to be restricted to administrators or privileged users. 7MTT versions below 2.0 do not enforce user authorization rules on file information and status that it has previously collected. The released version of 7MTT has been updated to maintain and verify authorization rules for file information, status and utilities.

Why it matters now

EPSS 0.00752 55th percentileScored 2026-11-07
Fix Fixed 7-Mode Transition Tool (NetApp): 2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NetApp7-Mode Transition Toolbefore 2.02.0Patch availableCNA
  • 7-Mode Transition Tool VendorNetApp Affected before 2.0 Fixed in 2.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netapp:7-mode_transition_tool:*:*:*:*:*:*:*:*before 2.0VulnerableNetApp
  • cpe:2.3:a:netapp:7-mode_transition_tool:*:*:*:*:*:*:*:* Versions before 2.0 Vulnerable ·NetApp

Remediation

  • Fix · CNA 7-Mode Transition Tool (NetApp) Fixed in 2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-5489
  2. 2026-10-03 Alias added: GHSA-2g6x-rfgr-7f5j

References

Advisory 1

  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2022-15084 Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets CVSS 3.1HIGH 7.5
  • TI-2022-05834 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle… CVSS 3.1HIGH 7.5
  • TI-2023-13226 Apache Tomcat: Fix for CVE-2023-24998 is incomplete CVSS 3.1HIGH 7.5
  • TI-2022-05732 Deserialization of untrusted data in Oracle Java SE JDK and JRE CVSS 3.1MEDIUM 5.3
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences