PT-2018-17014 · F5 · F5 Big-Ip

Publicado 2018-05-02 · Atualizado 2020-08-24 · CVE-2018-5520

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Média

Vetor base

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.2.1 through 11.6.3.1 F5 BIG-IP versions 12.1.0 through 12.1.3.1 F5 BIG-IP versions 13.0.0 through 13.1.0.5

Description The issue allows an administrative user to gain unauthorized access to file system resources using the dig utility in the TMOS Shell (tmsh) on systems configured in Appliance mode.

Recommendations For F5 BIG-IP versions 11.2.1 through 11.6.3.1, restrict access to the tmsh utility to minimize the risk of exploitation. For F5 BIG-IP versions 12.1.0 through 12.1.3.1, consider disabling the dig utility in the TMOS Shell until a fix is available. For F5 BIG-IP versions 13.0.0 through 13.1.0.5, limit the use of the tmsh utility to only necessary administrative tasks to reduce the risk of unauthorized access.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2018-5520

Produtos afetados

F5 Big-Ip

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-5520 · Aviso do Fabricante
• http://securitytracker.com/id/1040798 · Nota
• https://support.f5.com/csp/article/K02043709 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-5520 · Nota de Segurança