CVE-2017-0301
HighSummary
In F5 BIG-IP APM software versions 11.5.0 to 12.1.2, there is an issue where BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources.
Risk Assessment
The organization may be exposed to unauthorized access to internal resources, potentially leading to data leaks or other security incidents.
Recommendation
It is recommended to update F5 BIG-IP APM software to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in F5 BIG-IP APM
See all- CVE-2017-6129High
In F5 BIG-IP APM software versions 13.0.0 and 12.1.2, under certain circumstances, tunneled VPN flows can lead to a VPN/PPP connflow being prematurely freed or cause TMM to stop responding with a 'flow not in use' assertion.
- CVE-2015-8098Critical
F5 BIG-IP APM versions 11.4.1 before 11.4.1 HF9, 11.5.x before 11.5.3, and 11.6.0 before 11.6.0 HF4 contain a vulnerability that allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors related to processing a Citrix Remote Desktop connection through a virtual server configured with a remote desktop profile.
Original NVD description (English source)
In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources, however the application resources and backend servers are unaffected.