CVE-2017-0301 — F5 Big-ip Access Policy Manager vulnerability

6 documents5 sources

Severity

7.6HIGHNVD

EPSS

0.1%

top 67.06%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

F5 Networks INC Big-ip APM F5 Big-ip Access Policy Manager F5 Big-ip APM

Timeline

PublishedDec 21

Latest updateMay 13

Description

In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources, however the application resources and backend servers are unaffected.

CVSS vector

CVSS:3.0/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:HExploitability: 0.9 | Impact: 6.0

Affected Packages3 packages

▶NVDf5/big-ip_access_policy_manager11 versions+10

▶f5f5/big-ip_apm

▶CVEListV5f5_networks_inc/big-ip_apm11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1, 12.1.2+2

🔴Vulnerability Details

GHSA

GHSA-2v8v-crm8-62x6: In F5 BIG-IP APM software versions 11↗2022-05-13

▶

📋Vendor Advisories

CVE-2017-0301: In F5 BIG-IP APM software versions 11↗2017-12-21

▶

💬Community

Bugzilla

CVE-2017-12608 libreoffice: Out-of-bounds write in the WW8RStyle::ImportOldFormatStyles functionality↗2017-10-31

▶