Lucene search

[email protected]CVE-2018-15328

HistoryDec 12, 2018 - 2:29 p.m.

CVE-2018-15328

2018-12-1214:29:00

CWE-200

[email protected]

web.nvd.nist.gov

cve

2018

15328

big-ip

enterprise manager

big-iq

iworkflow

snmpv3

security vulnerability

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

46.7%

JSON

On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication and privacy are not handled by the BIG-IP system Secure Vault feature; they are written in the clear to the various configuration files.

Affected configurations

NVD

Node

f5big-ip_access_policy_managerRange11.2.1–11.6.3

f5big-ip_access_policy_managerRange12.1.0–12.1.3

f5big-ip_access_policy_managerRange13.0.0–13.1.1

f5big-ip_access_policy_managerMatch14.0.0

f5big-ip_advanced_firewall_managerRange11.2.1–11.6.3

f5big-ip_advanced_firewall_managerRange12.1.0–12.1.3

f5big-ip_advanced_firewall_managerRange13.0.0–13.1.1

f5big-ip_advanced_firewall_managerMatch14.0.0

f5big-ip_analyticsRange11.2.1–11.6.3

f5big-ip_analyticsRange12.1.0–12.1.3

f5big-ip_analyticsRange13.0.0–13.1.1

f5big-ip_analyticsMatch14.0.0

f5big-ip_application_acceleration_managerRange11.2.1–11.6.3

f5big-ip_application_acceleration_managerRange12.1.0–12.1.3

f5big-ip_application_acceleration_managerRange13.0.0–13.1.1

f5big-ip_application_acceleration_managerMatch14.0.0

f5big-ip_application_security_managerRange11.2.1–11.6.3

f5big-ip_application_security_managerRange12.1.0–12.1.3

f5big-ip_application_security_managerRange13.0.0–13.1.1

f5big-ip_application_security_managerMatch14.0.0

f5big-ip_domain_name_systemRange11.2.1–11.6.3

f5big-ip_domain_name_systemRange12.1.0–12.1.3

f5big-ip_domain_name_systemRange13.0.0–13.1.1

f5big-ip_domain_name_systemMatch14.0.0

f5big-ip_edge_gatewayRange11.2.1–11.6.3

f5big-ip_edge_gatewayRange12.1.0–12.1.3

f5big-ip_edge_gatewayRange13.0.0–13.1.1

f5big-ip_edge_gatewayMatch14.0.0

f5big-ip_fraud_protection_serviceRange11.2.1–11.6.3

f5big-ip_fraud_protection_serviceRange12.1.0–12.1.3

f5big-ip_fraud_protection_serviceRange13.0.0–13.1.1

f5big-ip_fraud_protection_serviceMatch14.0.0

f5big-ip_global_traffic_managerRange11.2.1–11.6.3

f5big-ip_global_traffic_managerRange12.1.0–12.1.3

f5big-ip_global_traffic_managerRange13.0.0–13.1.1

f5big-ip_global_traffic_managerMatch14.0.0

f5big-ip_link_controllerRange11.2.1–11.6.3

f5big-ip_link_controllerRange12.1.0–12.1.3

f5big-ip_link_controllerRange13.0.0–13.1.1

f5big-ip_link_controllerMatch14.0.0

f5big-ip_local_traffic_managerRange11.2.1–11.6.3

f5big-ip_local_traffic_managerRange12.1.0–12.1.3

f5big-ip_local_traffic_managerRange13.0.0–13.1.1

f5big-ip_local_traffic_managerMatch14.0.0

f5big-ip_policy_enforcement_managerRange11.2.1–11.6.3

f5big-ip_policy_enforcement_managerRange12.1.0–12.1.3

f5big-ip_policy_enforcement_managerRange13.0.0–13.1.1

f5big-ip_policy_enforcement_managerMatch14.0.0

f5big-ip_webacceleratorRange11.2.1–11.6.3

f5big-ip_webacceleratorRange12.1.0–12.1.3

f5big-ip_webacceleratorRange13.0.0–13.1.1

f5big-ip_webacceleratorMatch14.0.0

Node

f5enterprise_managerMatch3.1.1

Node

f5big-iq_centralized_managementRange5.0.0–5.4.0

f5big-iq_centralized_managementRange6.0.0–6.0.1

f5big-iq_centralized_managementMatch4.6.0

Node

f5iworkflowRange2.2.0–2.3.0

CPENameOperatorVersion
f5:big-ip_access_policy_managerf5 big-ip access policy managerle11.6.3
f5:big-ip_access_policy_managerf5 big-ip access policy managerle12.1.3
f5:big-ip_access_policy_managerf5 big-ip access policy managerle13.1.1
f5:big-ip_access_policy_managerf5 big-ip access policy managereq14.0.0
f5:big-ip_advanced_firewall_managerf5 big-ip advanced firewall managerle11.6.3
f5:big-ip_advanced_firewall_managerf5 big-ip advanced firewall managerle12.1.3
f5:big-ip_advanced_firewall_managerf5 big-ip advanced firewall managerle13.1.1
f5:big-ip_advanced_firewall_managerf5 big-ip advanced firewall managereq14.0.0
f5:big-ip_analyticsf5 big-ip analyticsle11.6.3
f5:big-ip_analyticsf5 big-ip analyticsle12.1.3

CPE	Name	Operator	Version
f5:big-ip_access_policy_manager	f5 big-ip access policy manager	le	11.6.3
f5:big-ip_access_policy_manager	f5 big-ip access policy manager	le	12.1.3
f5:big-ip_access_policy_manager	f5 big-ip access policy manager	le	13.1.1
f5:big-ip_access_policy_manager	f5 big-ip access policy manager	eq	14.0.0
f5:big-ip_advanced_firewall_manager	f5 big-ip advanced firewall manager	le	11.6.3
f5:big-ip_advanced_firewall_manager	f5 big-ip advanced firewall manager	le	12.1.3
f5:big-ip_advanced_firewall_manager	f5 big-ip advanced firewall manager	le	13.1.1
f5:big-ip_advanced_firewall_manager	f5 big-ip advanced firewall manager	eq	14.0.0
f5:big-ip_analytics	f5 big-ip analytics	le	11.6.3
f5:big-ip_analytics	f5 big-ip analytics	le	12.1.3

Rows per page:

1-10 of 521

CNA Affected

[
  {
    "product": "BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator), Enterprise Manager, BIG-IQ Centralized Management, F5 iWorkflow",
    "vendor": "F5 Networks, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "BIG-IP 14.0.x, 13.x, 12.x, 11.x"
      },
      {
        "status": "affected",
        "version": "EM 3.1.1"
      },
      {
        "status": "affected",
        "version": "BIG-IQ 6.x, 5.x, 4.x"
      },
      {
        "status": "affected",
        "version": "iWorkflow 2.x"
      }
    ]
  }
]

References

www.securityfocus.com/bid/106258

support.f5.com/csp/article/K42027747

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

46.7%

JSON

Related for CVE-2018-15328

f51 nessus1 cvelist1 prion1 nvd1