ID

VAR-201810-0900


CVE

CVE-2018-15322


TITLE

plural F5 Access control vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2018-011701

DESCRIPTION

On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 6.0.0-6.0.1, 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, iWorkflow 2.0.1-2.3.0, or Enterprise Manager 3.1.1 a BIG-IP user granted with tmsh access may cause the BIG-IP system to experience denial-of-service (DoS) when the BIG-IP user uses the tmsh utility to run the edit cli preference command and proceeds to save the changes to another filename repeatedly. This action utilises storage space on the /var partition and when performed repeatedly causes the /var partition to be full. plural F5 The product contains an access control vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. F5 BIG-IP and so on are all products of F5 Company in the United States. F5 BIG-IP is an all-in-one network device that integrates functions such as network traffic management, application security management, and load balancing. BIG-IQ Centralized Management is a software-based cloud management solution. Security flaws exist in several F5 products. An attacker could exploit this vulnerability to cause a denial of service. The following products and versions are affected: F5 BIG-IP Version 14.0.0 to Version 14.0.0.2, Version 13.0.0 to Version 13.1.0.7, Version 12.1.0 to Version 12.1.3.5, Version 11.6.0 to Version 11.6.3.2 , version 11.2.1 to version 11.5.6; BIG-IQ Centralized Management version 6.0.0 to version 6.0.1, version 5.0.0 to version 5.4.0, version 4.6.0; BIG-IQ Cloud and Orchestration 1.0.0 Version; iWorkflow 2.0.1 to 2.3.0; Enterprise Manager 3.1.1

Trust: 1.71

sources: NVD: CVE-2018-15322 // JVNDB: JVNDB-2018-011701 // VULHUB: VHN-125570

AFFECTED PRODUCTS

vendor:f5model:big-ip fraud protection servicescope:lteversion:12.1.3.5

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:lteversion:5.4.0

Trust: 1.0

vendor:f5model:big-iq cloud and orchestrationscope:eqversion:1.0.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:13.1.0.7

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:13.1.0.7

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:12.1.3.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:12.1.3.5

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:11.6.3.2

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:iworkflowscope:gteversion:2.0.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:13.1.0.7

Trust: 1.0

vendor:f5model:iworkflowscope:lteversion:2.3.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:gteversion:5.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:13.1.0.7

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:12.1.3.5

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:lteversion:13.1.0.7

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:12.1.3.5

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:13.1.0.7

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:12.1.3.5

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:13.1.0.7

Trust: 1.0

vendor:f5model:enterprise managerscope:eqversion:3.1.1

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:lteversion:12.1.3.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:11.6.3.2

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:12.1.3.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.6.3.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:12.1.3.5

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:11.6.3.2

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:13.1.0.7

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:11.6.3.2

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:lteversion:11.6.3.2

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:12.1.3.5

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:12.1.3.5

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:13.1.0.7

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:11.6.3.2

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:11.6.3.2

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:13.1.0.7

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:lteversion:6.0.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:12.1.3.5

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:11.6.3.2

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:11.6.3.2

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:eqversion:4.6.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:11.6.3.2

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:11.6.3.2

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:13.1.0.7

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:gteversion:6.0.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:13.1.0.7

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:13.1.0.7

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:12.1.3.5

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:11.6.3.2

Trust: 1.0

vendor:f5model:big-ip access policy managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip analyticsscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip domain name systemscope: - version: -

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope: - version: -

Trust: 0.8

vendor:f5model:big-ip enterprise managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope: - version: -

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip link controllerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip protocol security modulescope: - version: -

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope: - version: -

Trust: 0.8

vendor:f5model:big-iq centralized managementscope: - version: -

Trust: 0.8

vendor:f5model:big-iq cloud and orchestrationscope: - version: -

Trust: 0.8

vendor:f5model:iworkflowscope: - version: -

Trust: 0.8

vendor:f5model:big-ip analyticsscope:eqversion:11.6.3

Trust: 0.6

vendor:f5model:big-ip analyticsscope:eqversion:11.5.5

Trust: 0.6

vendor:f5model:big-ip analyticsscope:eqversion:11.4.0

Trust: 0.6

vendor:f5model:big-ip analyticsscope:eqversion:11.6.1

Trust: 0.6

vendor:f5model:big-ip analyticsscope:eqversion:11.6.2

Trust: 0.6

vendor:f5model:big-ip analyticsscope:eqversion:11.3.0

Trust: 0.6

vendor:f5model:big-ip analyticsscope:eqversion:11.5.0

Trust: 0.6

vendor:f5model:big-ip analyticsscope:eqversion:11.4.1

Trust: 0.6

vendor:f5model:big-ip analyticsscope:eqversion:11.5.6

Trust: 0.6

vendor:f5model:big-ip analyticsscope:eqversion:11.6.0

Trust: 0.6

sources: JVNDB: JVNDB-2018-011701 // CNNVD: CNNVD-201810-1541 // NVD: CVE-2018-15322

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-15322
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-15322
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201810-1541
value: MEDIUM

Trust: 0.6

VULHUB: VHN-125570
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-15322
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-125570
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-15322
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-125570 // JVNDB: JVNDB-2018-011701 // CNNVD: CNNVD-201810-1541 // NVD: CVE-2018-15322

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-284

Trust: 0.9

sources: VULHUB: VHN-125570 // JVNDB: JVNDB-2018-011701 // NVD: CVE-2018-15322

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201810-1541

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201810-1541

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-011701

PATCH

title:K28003839url:https://support.f5.com/csp/article/K28003839

Trust: 0.8

title:Multiple F5 Product security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=86516

Trust: 0.6

sources: JVNDB: JVNDB-2018-011701 // CNNVD: CNNVD-201810-1541

EXTERNAL IDS

db:NVDid:CVE-2018-15322

Trust: 2.5

db:JVNDBid:JVNDB-2018-011701

Trust: 0.8

db:CNNVDid:CNNVD-201810-1541

Trust: 0.7

db:VULHUBid:VHN-125570

Trust: 0.1

sources: VULHUB: VHN-125570 // JVNDB: JVNDB-2018-011701 // CNNVD: CNNVD-201810-1541 // NVD: CVE-2018-15322

REFERENCES

url:https://support.f5.com/csp/article/k28003839

Trust: 1.7

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15322

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2018-15322

Trust: 0.8

sources: VULHUB: VHN-125570 // JVNDB: JVNDB-2018-011701 // CNNVD: CNNVD-201810-1541 // NVD: CVE-2018-15322

SOURCES

db:VULHUBid:VHN-125570
db:JVNDBid:JVNDB-2018-011701
db:CNNVDid:CNNVD-201810-1541
db:NVDid:CVE-2018-15322

LAST UPDATE DATE

2024-11-23T22:48:33.428000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-125570date:2019-10-03T00:00:00
db:JVNDBid:JVNDB-2018-011701date:2019-01-18T00:00:00
db:CNNVDid:CNNVD-201810-1541date:2019-10-23T00:00:00
db:NVDid:CVE-2018-15322date:2024-11-21T03:50:33.577

SOURCES RELEASE DATE

db:VULHUBid:VHN-125570date:2018-10-31T00:00:00
db:JVNDBid:JVNDB-2018-011701date:2019-01-18T00:00:00
db:CNNVDid:CNNVD-201810-1541date:2018-11-01T00:00:00
db:NVDid:CVE-2018-15322date:2018-10-31T14:29:00.517