PT-2018-12981 · F5 · Big-Ip Apm

Published 2018-12-28 · Updated 2019-10-03 · CVE-2018-15335

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BIG-IP APM versions 13.0.0 through 13.1.x

Description The issue occurs when BIG-IP APM is deployed as an OAuth Resource Server and loses communication with an external OAuth authorization server. In such cases, APM may not display the intended message in the failure response.

Recommendations For versions 13.0.0 through 13.1.x, consider temporarily restricting access to the OAuth Resource Server functionality until a patch is available. As a mitigation measure, review and adjust the configuration settings related to communication with the external OAuth authorization server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2018-15335

Affected Products

Big-Ip Apm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-15335 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15335 · Vendor Advisory
• https://support.f5.com/csp/article/K27617652 · Vendor Advisory
• http://securityfocus.com/bid/106355 · Note