PT-2018-12960 · F5 · Edge Client+2

Published 2018-10-19 · Updated 2019-10-03 · CVE-2018-15316

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP APM versions 13.0.0 through 13.1.1.1 APM Client versions 7.1.5 through 7.1.6 Edge Client versions 7101 through 7160

Description The issue concerns the BIG-IP APM Edge Client component, which loads the policy library with user permission and bypasses endpoint checks.

Recommendations For F5 BIG-IP APM versions 13.0.0 through 13.1.1.1, consider restricting access to the policy library to prevent unauthorized loading. For APM Client versions 7.1.5 through 7.1.6, restrict the use of the Edge Client component until a fix is available. For Edge Client versions 7101 through 7160, disable the loading of the policy library with user permission to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2018-15316

Affected Products

Apm Client

Edge Client

F5 Big-Ip Apm

References · 5

• https://support.f5.com/csp/article/K51220077 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-15316 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15316 · Security Note
• http://securityfocus.com/bid/105731 · Note
• http://securitytracker.com/id/1041936 · Note