PT-2018-12960 · F5 · Edge Client+2

Publicado 2018-10-19 · Atualizado 2019-10-03 · CVE-2018-15316

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP APM versions 13.0.0 through 13.1.1.1 APM Client versions 7.1.5 through 7.1.6 Edge Client versions 7101 through 7160

Description The issue concerns the BIG-IP APM Edge Client component, which loads the policy library with user permission and bypasses endpoint checks.

Recommendations For F5 BIG-IP APM versions 13.0.0 through 13.1.1.1, consider restricting access to the policy library to prevent unauthorized loading. For APM Client versions 7.1.5 through 7.1.6, restrict the use of the Edge Client component until a fix is available. For Edge Client versions 7101 through 7160, disable the loading of the policy library with user permission to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2018-15316

Produtos afetados

Apm Client

Edge Client

F5 Big-Ip Apm

Referências · 5

• https://support.f5.com/csp/article/K51220077 · Aviso do Fabricante
• http://securityfocus.com/bid/105731 · Nota
• http://securitytracker.com/id/1041936 · Nota
• https://osv.dev/vulnerability/CVE-2018-15316 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-15316 · Nota de Segurança