CVE-2017-0301
HighSummary
In F5 BIG-IP APM software versions 11.5.0 to 12.1.2, there is an issue where BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources.
Risk Assessment
The organization may be exposed to unauthorized access to internal resources, potentially leading to data leaks or other security incidents.
Recommendation
It is recommended to update F5 BIG-IP APM software to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in F5 BIG-IP APM
See all- CVE-2017-6129High
In F5 BIG-IP APM software versions 13.0.0 and 12.1.2, under certain circumstances, tunneled VPN flows can lead to a VPN/PPP connflow being prematurely freed or cause TMM to stop responding with a 'flow not in use' assertion.
- CVE-2015-8098Critical
F5 BIG-IP APM versions 11.4.1 before 11.4.1 HF9, 11.5.x before 11.5.3, and 11.6.0 before 11.6.0 HF4 contain a vulnerability that allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors related to processing a Citrix Remote Desktop connection through a virtual server configured with a remote desktop profile.
- CVE-2022-29263High
F5 BIG-IP APM and APM Clients have a vulnerability related to improper handling of temporary files by the Edge Client Component Installer Service. Affected versions include 16.1.x before 16.1.2.2, 15.1.x before 15.1.5.1, 14.1.x before 14.1.4.6, 13.1.x before 13.1.5, all 12.1.x and 11.6.x, and APM Clients 7.x before 7.2.1.5.
Original NVD description (English source)
In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources, however the application resources and backend servers are unaffected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS