f5 big-ip advanced web application firewall, f5 big-ip application security manager, f5 big-ip fraud protection service
CVSS 4.9 · Medium EPSS 0,83%
Kerentanan Improper Restriction of XML External Entity Reference pada f5 big-ip advanced web application firewall, f5 big-ip application security manager +1 lainnya. Skor CVSS 3.1 4.9 (Medium) menurut NVD.
On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerability exists in an undisclosed page of the F5 Advanced Web Application Firewall (Advanced WAF) and BIG-IP ASM Traffic Management User Interface (TMUI), also referred to as the Configuration utility, that allows an authenticated high-privileged attacker to read local files and force BIG-IP to send HTTP requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| f5 | big-ip advanced web application firewall | Versi 14.1.0 hingga 14.1.4 |
| f5 | big-ip advanced web application firewall | Versi 15.1.0 hingga 15.1.3 |
| f5 | big-ip advanced web application firewall | Versi 16.0.0 hingga 16.1.0 |
| f5 | big-ip application security manager | Versi 14.1.0 hingga 14.1.4 |
| f5 | big-ip application security manager | Versi 15.1.0 hingga 15.1.3 |
| f5 | big-ip application security manager | Versi 16.0.0 hingga 16.1.0 |
| f5 | big-ip fraud protection service | Versi 14.1.0 hingga 14.1.4 |
| f5 | big-ip fraud protection service | Versi 15.1.0 hingga 15.1.3 |
| f5 | big-ip fraud protection service | Versi 16.0.0 hingga 16.1.0 |