CVE-2017-0304
published 2017-12-21CVE-2017-0304: A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12.0.0, 12.1.0, 12.1.1, 12.1.2 and 13.0.0 that may allow a copy of the…
PriorityP433medium5.4CVSS 3.0
AVNACLPRLUINSUCLILAN
EPSS
0.99%
58.6th percentile
A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12.0.0, 12.1.0, 12.1.1, 12.1.2 and 13.0.0 that may allow a copy of the firewall rules to be tampered with and impact the Configuration Utility until there is a resync of the rules. Traffic processing and the live firewall rules in use are not affected.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_afm | — | — |
| f5_networks_inc | big-ip_afm | — | — |
| f5_networks_inc | big-ip_afm | — | — |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
F5
CVE-2017-0304: A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12
vendor_f5·2017-12-21·CVSS 5.4
CVE-2017-0304 [MEDIUM] CWE-89 CVE-2017-0304: A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12
CVE-2017-0304: A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12
A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12.0.0, 12.1.0, 12.1.1, 12.1.2 and 13.0.0 that may allow a copy of the firewall rules to be tampered with and impact the Configuration Utility until there is a resync of the rules. Traffic processing and the live firewall rules in use are not affected.
Affected Products: BIG-IP AFM
Affected Versions: 12.0.0; 12.1.0; 12.1.1; 12.1.2; 13.0.0
F5 Advisory Articles: K39428424
F5 References: https://support.f5.com/csp/article/K39428424
GHSA
GHSA-56cq-cx36-9v3r: A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12
ghsa_unreviewed·2022-05-14
CVE-2017-0304 [MEDIUM] CWE-89 GHSA-56cq-cx36-9v3r: A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12
A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12.0.0, 12.1.0, 12.1.1, 12.1.2 and 13.0.0 that may allow a copy of the firewall rules to be tampered with and impact the Configuration Utility until there is a resync of the rules. Traffic processing and the live firewall rules in use are not affected.
No detection rules found.
No public exploits indexed.
2017-12-21
Published