SB2022032830 - Information disclosure in F5 BIG-IP iControl REST 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022032830

SB2022032830 - Information disclosure in F5 BIG-IP iControl REST

Published: March 28, 2022

Security Bulletin ID SB2022032830
Severity
Low
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Information disclosure (CVE-ID: CVE-2018-12536)

The disclosed vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to improper handling of queries that do not match the dynamic URL pattern for webapps that use default error handling settings. A remote attacker can send a query that submits malicious input, trigger a java.nio.file.InvalidPathException message, which could allow the attacker to view sensitive information, such as the software installation path.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References