CVE-2018-5520

On an F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.2.1-11.6.3.1 system configured in Appliance mode, the TMOS Shell (tmsh) may allow an administrative user to use the dig utility to gain unauthorized access to file system resources.

Score

CVSS 3.0 4.4 Medium

Status

Modified - f5sirt@f5.com

Published

2018-05-02

Last modified

2024-09-16

Weaknesses

CWE-863

Affected products

• Big-ip Access Policy Manager (F5)
• Big-ip Advanced Firewall Manager (F5)
• Big-ip Analytics (F5)
• Big-ip Application Acceleration Manager (F5)
• Big-ip Application Security Manager (F5)
• Big-ip Domain Name System (F5)
• Big-ip Edge Gateway (F5)
• Big-ip Global Traffic Manager (F5)
• Big-ip Link Controller (F5)
• Big-ip Local Traffic Manager (F5)
• Big-ip Policy Enforcement Manager (F5)
• Big-ip Webaccelerator (F5)
• Big-ip Websafe (F5)
• Aam (F5 Networks Inc.)
• Afm (F5 Networks Inc.)
• Analytics (F5 Networks Inc.)
• Apm (F5 Networks Inc.)
• Asm (F5 Networks Inc.)
• Big-ip Ltm (F5 Networks Inc.)
• Dns (F5 Networks Inc.)
• Edge Gateway (F5 Networks Inc.)
• Gtm (F5 Networks Inc.)
• Link Controller (F5 Networks Inc.)
• Pem (F5 Networks Inc.)
• Webaccelerator (F5 Networks Inc.)
• Websafe (F5 Networks Inc.)

References

• http://www.securitytracker.com/id/1040798
• https://support.f5.com/csp/article/K02043709