Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2018-15327 |
CWE-ID | CWE-264 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
BIG-IP Hardware solutions / Firmware |
Vendor | F5 Networks |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU15797
Risk: Low
CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-15327
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote administrative attacker to gain elevated privileges on the target system.
The weakness exists due to improper privileges and access controls. When authenticated administrative user runs commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.
The vulnerability has been fixed in the versions 14.0.0.3, 13.1.1.2.
Vulnerable software versionsBIG-IP: 13.0.0 - 14.0.0
External linkshttp://support.f5.com/csp/article/K20222812
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.