PT-2018-12981 · F5 · Big-Ip Apm

Publicado 2018-12-28 · Atualizado 2019-10-03 · CVE-2018-15335

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BIG-IP APM versions 13.0.0 through 13.1.x

Description The issue occurs when BIG-IP APM is deployed as an OAuth Resource Server and loses communication with an external OAuth authorization server. In such cases, APM may not display the intended message in the failure response.

Recommendations For versions 13.0.0 through 13.1.x, consider temporarily restricting access to the OAuth Resource Server functionality until a patch is available. As a mitigation measure, review and adjust the configuration settings related to communication with the external OAuth authorization server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2018-15335

Produtos afetados

Big-Ip Apm

Referências · 4

• http://securityfocus.com/bid/106355 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-15335 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-15335 · Aviso do Fabricante
• https://support.f5.com/csp/article/K27617652 · Aviso do Fabricante