Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-5516

On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.2, or 11.2.1-11.6.3.1, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, or F5 iWorkflow 2.0.2-2.3.0, authenticated users granted TMOS Shell (tmsh) access can access objects on the file system which would normally be disallowed by tmsh restrictions. This allows for authenticated, low privileged attackers to exfiltrate objects on the file system which should not be allowed.

Published

2018-05-02T13:29:00.617

Last Modified

2024-11-21T04:08:58.470

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 4.7 (MEDIUM)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:C/I:N/A:N

  • Access Vector: LOCAL
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

3.4

Impact Score

6.9

Weaknesses
  • Type: Primary
    CWE-732
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application f5 big-ip_local_traffic_manager ≤ 11.6.3 Yes
Application f5 big-ip_local_traffic_manager ≤ 12.1.2 Yes
Application f5 big-ip_local_traffic_manager ≤ 13.1.0 Yes
Application f5 big-ip_application_acceleration_manager ≤ 11.6.3 Yes
Application f5 big-ip_application_acceleration_manager ≤ 12.1.2 Yes
Application f5 big-ip_application_acceleration_manager ≤ 13.1.0 Yes
Application f5 big-ip_advanced_firewall_manager ≤ 11.6.3 Yes
Application f5 big-ip_advanced_firewall_manager ≤ 12.1.2 Yes
Application f5 big-ip_advanced_firewall_manager ≤ 13.1.0 Yes
Application f5 big-ip_analytics ≤ 11.6.3 Yes
Application f5 big-ip_analytics ≤ 12.1.2 Yes
Application f5 big-ip_analytics ≤ 13.1.0 Yes
Application f5 big-ip_access_policy_manager ≤ 11.6.3 Yes
Application f5 big-ip_access_policy_manager ≤ 12.1.2 Yes
Application f5 big-ip_access_policy_manager ≤ 13.1.0 Yes
Application f5 big-ip_application_security_manager ≤ 11.6.3 Yes
Application f5 big-ip_application_security_manager ≤ 12.1.2 Yes
Application f5 big-ip_application_security_manager ≤ 13.1.0 Yes
Application f5 big-ip_edge_gateway ≤ 11.6.3 Yes
Application f5 big-ip_edge_gateway ≤ 12.1.2 Yes
Application f5 big-ip_edge_gateway ≤ 13.1.0 Yes
Application f5 big-ip_global_traffic_manager ≤ 11.6.3 Yes
Application f5 big-ip_global_traffic_manager ≤ 12.1.2 Yes
Application f5 big-ip_global_traffic_manager ≤ 13.1.0 Yes
Application f5 big-ip_link_controller ≤ 11.6.3 Yes
Application f5 big-ip_link_controller ≤ 12.1.2 Yes
Application f5 big-ip_link_controller ≤ 13.1.0 Yes
Application f5 big-ip_policy_enforcement_manager ≤ 11.6.3 Yes
Application f5 big-ip_policy_enforcement_manager ≤ 12.1.2 Yes
Application f5 big-ip_policy_enforcement_manager ≤ 13.1.0 Yes
Application f5 big-ip_webaccelerator ≤ 11.6.3 Yes
Application f5 big-ip_webaccelerator ≤ 12.1.2 Yes
Application f5 big-ip_webaccelerator ≤ 13.1.0 Yes
Application f5 big-ip_websafe ≤ 11.6.3 Yes
Application f5 big-ip_websafe ≤ 12.1.2 Yes
Application f5 big-ip_websafe ≤ 13.1.0 Yes
Application f5 big-ip_domain_name_system ≤ 11.6.3 Yes
Application f5 big-ip_domain_name_system ≤ 12.1.2 Yes
Application f5 big-ip_domain_name_system ≤ 13.1.0 Yes
Application f5 big-ip_enterprise_manager 3.1.1 Yes
Application f5 big-iq_centralized_management ≤ 5.4.0 Yes
Application f5 big-iq_centralized_management 4.6.0 Yes
Application f5 big-iq_cloud_and_orchestration 1.0.0 Yes
Application f5 f5_iworkflow ≤ 2.3.0 Yes
References