Lucene search

[email protected]CVE-2018-5520

HistoryMay 02, 2018 - 1:29 p.m.

CVE-2018-5520

2018-05-0213:29:00

CWE-863

[email protected]

web.nvd.nist.gov

cve-2018-5520

f5 big-ip

tmos

shell

appliance mode

dig utility

unauthorized access

file system

nvd

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

4.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.4%

JSON

On an F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.2.1-11.6.3.1 system configured in Appliance mode, the TMOS Shell (tmsh) may allow an administrative user to use the dig utility to gain unauthorized access to file system resources.

Affected configurations

NVD

Node

f5big-ip_local_traffic_managerRange11.2.1–11.6.3

f5big-ip_local_traffic_managerRange12.1.0–12.1.3

f5big-ip_local_traffic_managerRange13.0.0–13.1.0

Node

f5big-ip_application_acceleration_managerRange11.2.1–11.6.3

f5big-ip_application_acceleration_managerRange12.1.0–12.1.3

f5big-ip_application_acceleration_managerRange13.0.0–13.1.0

Node

f5big-ip_advanced_firewall_managerRange11.2.1–11.6.3

f5big-ip_advanced_firewall_managerRange12.1.0–12.1.3

f5big-ip_advanced_firewall_managerRange13.0.0–13.1.0

Node

f5big-ip_analyticsRange11.2.1–11.6.3

f5big-ip_analyticsRange12.1.0–12.1.3

f5big-ip_analyticsRange13.0.0–13.1.0

Node

f5big-ip_access_policy_managerRange11.2.1–11.6.3

f5big-ip_access_policy_managerRange12.1.0–12.1.3

f5big-ip_access_policy_managerRange13.0.0–13.1.0

Node

f5big-ip_application_security_managerRange11.2.1–11.6.3

f5big-ip_application_security_managerRange12.1.0–12.1.3

f5big-ip_application_security_managerRange13.0.0–13.1.0

Node

f5big-ip_edge_gatewayRange11.2.1–11.6.3

f5big-ip_edge_gatewayRange12.1.0–12.1.3

f5big-ip_edge_gatewayRange13.0.0–13.1.0

Node

f5big-ip_global_traffic_managerRange11.2.1–11.6.3

f5big-ip_global_traffic_managerRange12.1.0–12.1.3

f5big-ip_global_traffic_managerRange13.0.0–13.1.0

Node

f5big-ip_link_controllerRange11.2.1–11.6.3

f5big-ip_link_controllerRange12.1.0–12.1.3

f5big-ip_link_controllerRange13.0.0–13.1.0

Node

f5big-ip_policy_enforcement_managerRange11.2.1–11.6.3

f5big-ip_policy_enforcement_managerRange12.1.0–12.1.3

f5big-ip_policy_enforcement_managerRange13.0.0–13.1.0

Node

f5big-ip_webacceleratorRange11.2.1–11.6.3

f5big-ip_webacceleratorRange12.1.0–12.1.3

f5big-ip_webacceleratorRange13.0.0–13.1.0

Node

f5big-ip_websafeRange11.2.1–11.6.3

f5big-ip_websafeRange12.1.0–12.1.3

f5big-ip_websafeRange13.0.0–13.1.0

Node

f5big-ip_domain_name_systemRange11.2.1–11.6.3

f5big-ip_domain_name_systemRange12.1.0–12.1.3

f5big-ip_domain_name_systemRange13.0.0–13.1.0

CPENameOperatorVersion
f5:big-ip_local_traffic_managerf5 big-ip local traffic managerle11.6.3
f5:big-ip_local_traffic_managerf5 big-ip local traffic managerle12.1.3
f5:big-ip_local_traffic_managerf5 big-ip local traffic managerle13.1.0

CPE	Name	Operator	Version
f5:big-ip_local_traffic_manager	f5 big-ip local traffic manager	le	11.6.3
f5:big-ip_local_traffic_manager	f5 big-ip local traffic manager	le	12.1.3
f5:big-ip_local_traffic_manager	f5 big-ip local traffic manager	le	13.1.0

CNA Affected

[
  {
    "product": "BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, WebSafe)",
    "vendor": "F5 Networks, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "13.0.0-13.1.0.5"
      },
      {
        "status": "affected",
        "version": "12.1.0-12.1.3.1"
      },
      {
        "status": "affected",
        "version": "11.2.1-11.6.3.1"
      }
    ]
  }
]

References

www.securitytracker.com/id/1040798

support.f5.com/csp/article/K02043709

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

4.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.4%

JSON

Related for CVE-2018-5520

nessus1 prion1 cvelist1 f51 nvd1