VulnerabilityModified

CVE-2015-8022

HIGH 7.5EPSS 2.67%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, and Link Controller 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP AAM 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP AFM and PEM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP Edge Gateway, WebAccelerator, and WOM 11.x before 11.2.1 HF16 and 11.3.0; and BIG-IP PSM 11.x before 11.2.1 HF16, 11.3.x, and 11.4.x before 11.4.1 HF10 allows remote authenticated users with certain permissions to gain privileges by leveraging an Access Policy Manager customization configuration section that allows file uploads.

CVSS 3.0: 7.5 HIGHCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 2.67% probability · 85th percentile
CISA KEV: Not listed
Weakness: CWE-264
Affected: f5/big-ip global traffic manager · f5/big-ip local traffic manager · f5/big-ip webaccelerator · f5/big-ip policy enforcement manager · f5/big-ip advanced firewall manager · f5/big-ip access policy manager · f5/big-ip analytics · f5/big-ip wan optimization manager · f5/big-ip link controller · f5/big-ip edge gateway · f5/big-ip application security manager · f5/big-ip application acceleration manager · f5/big-ip websafe · f5/big-ip protocol security module
Source: cve@mitre.org

References

http://www.securitytracker.com/id/1036627Third Party Advisory, VDB Entry
https://support.f5.com/kb/en-us/solutions/public/k/12/sol12401251.htmlVendor Advisory
http://www.securitytracker.com/id/1036627Third Party Advisory, VDB Entry
https://support.f5.com/kb/en-us/solutions/public/k/12/sol12401251.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.