CVE-2018-5511

high · 7.2

On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.

7.2

CVSS

14.5%

EPSS (exploit prob.)

96th

EPSS percentile

2018-04-13

Published

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-470

Affected products

Vendor	Product	Affected versions
f5	big-ip_local_traffic_manager	13.0.0
f5	big-ip_local_traffic_manager	13.1.0
f5	big-ip_application_acceleration_manager	13.0.0
f5	big-ip_application_acceleration_manager	13.1.0
f5	big-ip_advanced_firewall_manager	13.0.0
f5	big-ip_advanced_firewall_manager	13.1.0
f5	big-ip_analytics	13.0.0
f5	big-ip_analytics	13.1.0
f5	big-ip_access_policy_manager	13.0.0
f5	big-ip_access_policy_manager	13.1.0
f5	big-ip_application_security_manager	13.0.0
f5	big-ip_application_security_manager	13.1.0
f5	big-ip_edge_gateway	13.0.0
f5	big-ip_edge_gateway	13.1.0
f5	big-ip_global_traffic_manager	13.0.0
f5	big-ip_global_traffic_manager	13.1.0
f5	big-ip_link_controller	13.0.0
f5	big-ip_link_controller	13.1.0
f5	big-ip_policy_enforcement_manager	13.0.0
f5	big-ip_policy_enforcement_manager	13.1.0
f5	big-ip_webaccelerator	13.0.0
f5	big-ip_webaccelerator	13.1.0
f5	big-ip_websafe	13.0.0
f5	big-ip_websafe	13.1.0
f5	big-ip_domain_name_system	13.0.0
f5	big-ip_domain_name_system	13.1.0
f5	big-ip_enterprise_manager	3.1.1
vmware	workstation	14.1.5
microsoft	windows_10	all versions
vmware	workstation_player	15.0.2

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-5511