Lucene search

[email protected]CVE-2018-5523

HistoryJun 01, 2018 - 2:29 p.m.

CVE-2018-5523

2018-06-0114:29:00

[email protected]

web.nvd.nist.gov

big-ip

cve-2018-5523

security vulnerability

tmui

command restriction bypass

enterprise manager

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.7%

JSON

On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 and Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.

Affected configurations

NVD

Node

f5big-ip_application_acceleration_managerRange11.5.1–11.5.5

f5big-ip_application_acceleration_managerRange11.6.1–11.6.3

f5big-ip_application_acceleration_managerRange12.1.0–12.1.3

f5big-ip_application_acceleration_managerMatch11.2.1

f5big-ip_application_acceleration_managerMatch13.0.0

f5big-ip_application_acceleration_managerMatch13.1.0

Node

f5big-ip_local_traffic_managerRange11.5.1–11.5.5

f5big-ip_local_traffic_managerRange11.6.1–11.6.3

f5big-ip_local_traffic_managerRange12.1.0–12.1.3

f5big-ip_local_traffic_managerMatch11.2.1

f5big-ip_local_traffic_managerMatch13.0.0

f5big-ip_local_traffic_managerMatch13.1.0

Node

f5big-ip_advanced_firewall_managerRange11.5.1–11.5.5

f5big-ip_advanced_firewall_managerRange11.6.1–11.6.3

f5big-ip_advanced_firewall_managerRange12.1.0–12.1.3

f5big-ip_advanced_firewall_managerMatch11.2.1

f5big-ip_advanced_firewall_managerMatch13.0.0

f5big-ip_advanced_firewall_managerMatch13.1.0

Node

f5big-ip_analyticsRange11.5.1–11.5.5

f5big-ip_analyticsRange11.6.1–11.6.3

f5big-ip_analyticsRange12.1.0–12.1.3

f5big-ip_analyticsMatch11.2.1

f5big-ip_analyticsMatch13.0.0

f5big-ip_analyticsMatch13.1.0

Node

f5big-ip_access_policy_managerRange11.5.1–11.5.5

f5big-ip_access_policy_managerRange11.6.1–11.6.3

f5big-ip_access_policy_managerRange12.1.0–12.1.3

f5big-ip_access_policy_managerMatch11.2.1

f5big-ip_access_policy_managerMatch13.0.0

f5big-ip_access_policy_managerMatch13.1.0

Node

f5big-ip_application_security_managerRange11.5.1–11.5.5

f5big-ip_application_security_managerRange11.6.1–11.6.3

f5big-ip_application_security_managerRange12.1.0–12.1.3

f5big-ip_application_security_managerMatch11.2.1

f5big-ip_application_security_managerMatch13.0.0

f5big-ip_application_security_managerMatch13.1.0

Node

f5big-ip_domain_name_systemRange11.5.1–11.5.5

f5big-ip_domain_name_systemRange11.6.1–11.6.3

f5big-ip_domain_name_systemRange12.1.0–12.1.3

f5big-ip_domain_name_systemMatch11.2.1

f5big-ip_domain_name_systemMatch13.0.0

f5big-ip_domain_name_systemMatch13.1.0

Node

f5big-ip_edge_gatewayRange11.5.1–11.5.5

f5big-ip_edge_gatewayRange11.6.1–11.6.3

f5big-ip_edge_gatewayRange12.1.0–12.1.3

f5big-ip_edge_gatewayMatch11.2.1

f5big-ip_edge_gatewayMatch13.0.0

f5big-ip_edge_gatewayMatch13.1.0

Node

f5big-ip_global_traffic_managerRange11.5.1–11.5.5

f5big-ip_global_traffic_managerRange11.6.1–11.6.3

f5big-ip_global_traffic_managerRange12.1.0–12.1.3

f5big-ip_global_traffic_managerMatch11.2.1

f5big-ip_global_traffic_managerMatch13.0.0

f5big-ip_global_traffic_managerMatch13.1.0

Node

f5big-ip_link_controllerRange11.5.1–11.5.5

f5big-ip_link_controllerRange11.6.1–11.6.3

f5big-ip_link_controllerRange12.1.0–12.1.3

f5big-ip_link_controllerMatch11.2.1

f5big-ip_link_controllerMatch13.0.0

f5big-ip_link_controllerMatch13.1.0

Node

f5big-ip_policy_enforcement_managerRange11.5.1–11.5.5

f5big-ip_policy_enforcement_managerRange11.6.1–11.6.3

f5big-ip_policy_enforcement_managerRange12.1.0–12.1.3

f5big-ip_policy_enforcement_managerMatch11.2.1

f5big-ip_policy_enforcement_managerMatch13.0.0

f5big-ip_policy_enforcement_managerMatch13.1.0

Node

f5big-ip_webacceleratorRange11.5.1–11.5.5

f5big-ip_webacceleratorRange11.6.1–11.6.3

f5big-ip_webacceleratorRange12.1.0–12.1.3

f5big-ip_webacceleratorMatch11.2.1

f5big-ip_webacceleratorMatch13.0.0

f5big-ip_webacceleratorMatch13.1.0

Node

f5big-ip_fraud_protection_serviceRange11.5.1–11.5.5

f5big-ip_fraud_protection_serviceRange11.6.1–11.6.3

f5big-ip_fraud_protection_serviceRange12.1.0–12.1.3

f5big-ip_fraud_protection_serviceMatch11.2.1

f5big-ip_fraud_protection_serviceMatch13.0.0

f5big-ip_fraud_protection_serviceMatch13.1.0

Node

f5enterprise_managerMatch3.1.1

CPENameOperatorVersion
f5:big-ip_application_acceleration_managerf5 big-ip application acceleration managerle11.5.5
f5:big-ip_application_acceleration_managerf5 big-ip application acceleration managerle11.6.3
f5:big-ip_application_acceleration_managerf5 big-ip application acceleration managerle12.1.3
f5:big-ip_application_acceleration_managerf5 big-ip application acceleration managereq11.2.1
f5:big-ip_application_acceleration_managerf5 big-ip application acceleration managereq13.0.0
f5:big-ip_application_acceleration_managerf5 big-ip application acceleration managereq13.1.0

CPE	Name	Operator	Version
f5:big-ip_application_acceleration_manager	f5 big-ip application acceleration manager	le	11.5.5
f5:big-ip_application_acceleration_manager	f5 big-ip application acceleration manager	le	11.6.3
f5:big-ip_application_acceleration_manager	f5 big-ip application acceleration manager	le	12.1.3
f5:big-ip_application_acceleration_manager	f5 big-ip application acceleration manager	eq	11.2.1
f5:big-ip_application_acceleration_manager	f5 big-ip application acceleration manager	eq	13.0.0
f5:big-ip_application_acceleration_manager	f5 big-ip application acceleration manager	eq	13.1.0

CNA Affected

[
  {
    "product": "BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)",
    "vendor": "F5 Networks, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, 11.2.1"
      }
    ]
  },
  {
    "product": "Enterprise Manager",
    "vendor": "F5 Networks, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "3.1.1"
      }
    ]
  }
]

References

www.securitytracker.com/id/1041022

www.securitytracker.com/id/1041023

support.f5.com/csp/article/K50254952

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.7%

JSON

Related for CVE-2018-5523

nvd1 cvelist1 f51 nessus1 prion1