ID

VAR-201806-1785


CVE

CVE-2018-5525


TITLE

plural F5 BIG-IP Configuration utility Vulnerable to information disclosure

Trust: 0.8

sources: JVNDB: JVNDB-2018-006246

DESCRIPTION

A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive customer data. plural F5 BIG-IP Configuration utility Contains an information disclosure vulnerability.Information may be obtained. F5 BIG-IP LTM, etc. are all products of F5 Company in the United States. F5 BIG-IP LTM is a local traffic manager; BIG-IP AAM is an application acceleration manager. Configuration utility is one of the configuration utilities. The following products and versions are affected: F5 BIG-IP LTM Release 13.0.0, Release 12.1.0 to Release 12.1.2, Release 11.6.0 to Release 11.6.3, Release 11.2.1 to Release 11.5.5; BIG-IP AAM 13.0.0, 12.1.0 to 12.1.2, 11.6.0 to 11.6.3, 11.2.1 to 11.5.5; BIG-IP AFM 13.0.0, 12.1.0 to Version 12.1.2, Version 11.6.0 to Version 11.6.3, Version 11.2.1 to Version 11.5.5; BIG-IP Analytics Version 13.0.0, Version 12.1.0 to Version 12.1.2, Version 11.6.0 to Version 11.6 .3 version, 11.2.1 to 11.5.5 version; BIG-IP APM 13.0.0 version, 12.1.0 to 12.1.2 version, 11.6.0 to 11.6.3 version, 11.2.1 to 11.5 version. 5; BIG-IP ASM 13.0.0, 12.1.0 to 12.1.2, 11.6.0 to 11.6.3, 11.2.1 to 11.5.5; BIG-IP DNS 13.0.0 , Version 12.1.0 to Version 12.1.2, Version 11.6.0 to Version 11.6.3, Version 11.2.1 to Version 11.5.5; BIG-IP Edge Gateway Version 13.0.0, Version 12.1.0 to Version 12.1.2 , 11.6.0 to 11.6.3, 11.2.1 to 11.5.5; BIG-IP FPS 13.0.0, 12.1.0 to 12.1.2, 11.6.0 to 11.6.3, Version 11.2.1 to 11.5

Trust: 1.71

sources: NVD: CVE-2018-5525 // JVNDB: JVNDB-2018-006246 // VULHUB: VHN-135556

AFFECTED PRODUCTS

vendor:f5model:big-ip access policy managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip advanced firewall managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip analyticsscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip application security managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip domain name systemscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip edge gatewayscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip fraud protection servicescope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip global traffic managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip link controllerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip local traffic managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip webacceleratorscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip edge gatewayscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:ltversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:ltversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:ltversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip link controllerscope:ltversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:ltversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:ltversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:13.1.0.4

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:ltversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip application security managerscope:ltversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:ltversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:ltversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:ltversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip analyticsscope:ltversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:ltversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:eqversion:11.2.1

Trust: 0.8

vendor:f5model:big-ip access policy managerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip access policy managerscope:eqversion:11.6.3.1 for up to 11.6.1

Trust: 0.8

vendor:f5model:big-ip access policy managerscope:eqversion:12.1.0 to 12.1.2

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope:eqversion:11.2.1

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope:eqversion:11.6.3.1 for up to 11.6.1

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope:eqversion:12.1.0 to 12.1.2

Trust: 0.8

vendor:f5model:big-ip analyticsscope:eqversion:11.2.1

Trust: 0.8

vendor:f5model:big-ip analyticsscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip analyticsscope:eqversion:11.6.3.1 for up to 11.6.1

Trust: 0.8

vendor:f5model:big-ip analyticsscope:eqversion:12.1.0 to 12.1.2

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.2.1

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.6.3.1 for up to 11.6.1

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:12.1.0 to 12.1.2

Trust: 0.8

vendor:f5model:big-ip application security managerscope:eqversion:11.2.1

Trust: 0.8

vendor:f5model:big-ip application security managerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip application security managerscope:eqversion:11.6.3.1 for up to 11.6.1

Trust: 0.8

vendor:f5model:big-ip application security managerscope:eqversion:12.1.0 to 12.1.2

Trust: 0.8

vendor:f5model:big-ip domain name systemscope:eqversion:11.2.1

Trust: 0.8

vendor:f5model:big-ip domain name systemscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip domain name systemscope:eqversion:11.6.3.1 for up to 11.6.1

Trust: 0.8

vendor:f5model:big-ip domain name systemscope:eqversion:12.1.0 to 12.1.2

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope:eqversion:11.2.1

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope:eqversion:11.6.3.1 for up to 11.6.1

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope:eqversion:12.1.0 to 12.1.2

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope:eqversion:11.2.1

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope:eqversion:11.6.3.1 for up to 11.6.1

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope:eqversion:12.1.0 to 12.1.2

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope:eqversion:11.2.1

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope:eqversion:11.6.3.1 for up to 11.6.1

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope:eqversion:12.1.0 to 12.1.2

Trust: 0.8

vendor:f5model:big-ip link controllerscope:eqversion:11.2.1

Trust: 0.8

vendor:f5model:big-ip link controllerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip link controllerscope:eqversion:11.6.3.1 for up to 11.6.1

Trust: 0.8

vendor:f5model:big-ip link controllerscope:eqversion:12.1.0 to 12.1.2

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope:eqversion:11.2.1

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope:eqversion:11.6.3.1 for up to 11.6.1

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope:eqversion:12.1.0 to 12.1.2

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:11.2.1

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:11.6.3.1 for up to 11.6.1

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:12.1.0 to 12.1.2

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope:eqversion:11.2.1

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope:eqversion:11.6.3.1 for up to 11.6.1

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope:eqversion:12.1.0 to 12.1.2

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.5.2

Trust: 0.6

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.4.0

Trust: 0.6

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.4.1

Trust: 0.6

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.5.4

Trust: 0.6

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.5.3

Trust: 0.6

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.6.0

Trust: 0.6

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.5.1

Trust: 0.6

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.5.5

Trust: 0.6

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.5.0

Trust: 0.6

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.3.0

Trust: 0.6

sources: JVNDB: JVNDB-2018-006246 // CNNVD: CNNVD-201806-142 // NVD: CVE-2018-5525

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-5525
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-5525
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201806-142
value: MEDIUM

Trust: 0.6

VULHUB: VHN-135556
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-5525
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-135556
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-5525
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 1.4
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-135556 // JVNDB: JVNDB-2018-006246 // CNNVD: CNNVD-201806-142 // NVD: CVE-2018-5525

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

sources: VULHUB: VHN-135556 // JVNDB: JVNDB-2018-006246 // NVD: CVE-2018-5525

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201806-142

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201806-142

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-006246

PATCH

title:K00363258url:https://support.f5.com/csp/article/K00363258

Trust: 0.8

title:Multiple F5 product Configuration utility Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=80499

Trust: 0.6

sources: JVNDB: JVNDB-2018-006246 // CNNVD: CNNVD-201806-142

EXTERNAL IDS

db:NVDid:CVE-2018-5525

Trust: 2.5

db:SECTRACKid:1041018

Trust: 1.7

db:JVNDBid:JVNDB-2018-006246

Trust: 0.8

db:CNNVDid:CNNVD-201806-142

Trust: 0.7

db:VULHUBid:VHN-135556

Trust: 0.1

sources: VULHUB: VHN-135556 // JVNDB: JVNDB-2018-006246 // CNNVD: CNNVD-201806-142 // NVD: CVE-2018-5525

REFERENCES

url:https://support.f5.com/csp/article/k00363258

Trust: 1.7

url:http://www.securitytracker.com/id/1041018

Trust: 1.7

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5525

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2018-5525

Trust: 0.8

sources: VULHUB: VHN-135556 // JVNDB: JVNDB-2018-006246 // CNNVD: CNNVD-201806-142 // NVD: CVE-2018-5525

SOURCES

db:VULHUBid:VHN-135556
db:JVNDBid:JVNDB-2018-006246
db:CNNVDid:CNNVD-201806-142
db:NVDid:CVE-2018-5525

LAST UPDATE DATE

2024-11-23T22:06:46.563000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-135556date:2018-08-01T00:00:00
db:JVNDBid:JVNDB-2018-006246date:2018-08-13T00:00:00
db:CNNVDid:CNNVD-201806-142date:2018-06-04T00:00:00
db:NVDid:CVE-2018-5525date:2024-11-21T04:08:59.743

SOURCES RELEASE DATE

db:VULHUBid:VHN-135556date:2018-06-01T00:00:00
db:JVNDBid:JVNDB-2018-006246date:2018-08-13T00:00:00
db:CNNVDid:CNNVD-201806-142date:2018-06-04T00:00:00
db:NVDid:CVE-2018-5525date:2018-06-01T14:29:00.690