PT-2018-12979 · F5 · Big-Ip

Published 2018-12-28 · Updated 2019-10-23 · CVE-2018-15333

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.2.1 and greater

Description The issue allows a BIG-IP system's user with any role, including the Guest Role, to access and download previously generated snapshot files, such as QKView and TCPDumps, through unrestricted Snapshot File Access in the BIG-IP configuration utility.

Recommendations For versions 11.2.1 and greater, restrict access to the Snapshot File Access feature to minimize the risk of unauthorized access to sensitive files. Consider limiting the roles that can access snapshot files to only those that require it, and remove access for the Guest Role.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-15333

Affected Products

Big-Ip

References · 5

• https://support.f5.com/csp/article/K53620021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15333 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15333 · Vendor Advisory
• http://securityfocus.com/bid/106380 · Note
• https://support.f5.com/csp/article/K53620021?utm_source=f5support&amp%3Butm_medium=RSS · Note