5.5

CVE-2014-6032

Exploit

EPSS 2.9%
Veröffentlicht 01.11.2014 23:55:09
Zuletzt bearbeitet 06.05.2026 22:30:45
Erkennungen
Login

Multiple XML External Entity (XXE) vulnerabilities in the Configuration utility in F5 BIG-IP LTM, ASM, GTM, and Link Controller 11.0 through 11.6.0 and 10.0.0 through 10.2.4, AAM 11.4.0 through 11.6.0, ARM 11.3.0 through 11.6.0, Analytics 11.0.0 through 11.6.0, APM and Edge Gateway 11.0.0 through 11.6.0 and 10.1.0 through 10.2.4, PEM 11.3.0 through 11.6.0, PSM 11.0.0 through 11.4.1 and 10.0.0 through 10.2.4, and WOM 11.0.0 through 11.3.0 and 10.0.0 through 10.2.4 and Enterprise Manager 3.0.0 through 3.1.1 and 2.1.0 through 2.3.0 allow remote authenticated users to read arbitrary files and cause a denial of service via a crafted request, as demonstrated using (1) viewList or (2) deal elements.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 15

NVD 167 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

F5 ≫ Big-ip Protocol Security Module Version 10.0.0

F5 ≫ Big-ip Protocol Security Module Version 10.1.0

F5 ≫ Big-ip Protocol Security Module Version 10.2.0

F5 ≫ Big-ip Protocol Security Module Version 10.2.1

F5 ≫ Big-ip Protocol Security Module Version 10.2.2

F5 ≫ Big-ip Protocol Security Module Version 10.2.3

F5 ≫ Big-ip Protocol Security Module Version 10.2.4

F5 ≫ Big-ip Protocol Security Module Version 11.0.0

F5 ≫ Big-ip Protocol Security Module Version 11.1.0

F5 ≫ Big-ip Protocol Security Module Version 11.2.0

F5 ≫ Big-ip Protocol Security Module Version 11.2.1

F5 ≫ Big-ip Protocol Security Module Version 11.3.0

F5 ≫ Big-ip Protocol Security Module Version 11.4.0

F5 ≫ Big-ip Protocol Security Module Version 11.4.1

F5 ≫ Big-ip Global Traffic Manager Version 10.0.0

F5 ≫ Big-ip Global Traffic Manager Version 10.1.0

F5 ≫ Big-ip Global Traffic Manager Version 10.2.0

F5 ≫ Big-ip Global Traffic Manager Version 10.2.1

F5 ≫ Big-ip Global Traffic Manager Version 10.2.2

F5 ≫ Big-ip Global Traffic Manager Version 10.2.3

F5 ≫ Big-ip Global Traffic Manager Version 10.2.4

F5 ≫ Big-ip Global Traffic Manager Version 11.0.0

F5 ≫ Big-ip Global Traffic Manager Version 11.1.0

F5 ≫ Big-ip Global Traffic Manager Version 11.2.0

F5 ≫ Big-ip Global Traffic Manager Version 11.2.1

F5 ≫ Big-ip Global Traffic Manager Version 11.3.0

F5 ≫ Big-ip Global Traffic Manager Version 11.4.0

F5 ≫ Big-ip Global Traffic Manager Version 11.4.1

F5 ≫ Big-ip Global Traffic Manager Version 11.5.0

F5 ≫ Big-ip Global Traffic Manager Version 11.5.1

F5 ≫ Big-ip Global Traffic Manager Version 11.6.0

F5 ≫ Big-ip Policy Enforcement Manager Version 11.3.0

F5 ≫ Big-ip Policy Enforcement Manager Version 11.4.0

F5 ≫ Big-ip Policy Enforcement Manager Version 11.4.1

F5 ≫ Big-ip Policy Enforcement Manager Version 11.5.0

F5 ≫ Big-ip Policy Enforcement Manager Version 11.5.1

F5 ≫ Big-ip Policy Enforcement Manager Version 11.6.0

F5 ≫ Big-ip Wan Optimization Manager Version 10.0.0

F5 ≫ Big-ip Wan Optimization Manager Version 10.1.0

F5 ≫ Big-ip Wan Optimization Manager Version 10.2.0

F5 ≫ Big-ip Wan Optimization Manager Version 10.2.1

F5 ≫ Big-ip Wan Optimization Manager Version 10.2.2

F5 ≫ Big-ip Wan Optimization Manager Version 10.2.3

F5 ≫ Big-ip Wan Optimization Manager Version 10.2.4

F5 ≫ Big-ip Wan Optimization Manager Version 11.0.0

F5 ≫ Big-ip Wan Optimization Manager Version 11.1.0

F5 ≫ Big-ip Wan Optimization Manager Version 11.2.0

F5 ≫ Big-ip Wan Optimization Manager Version 11.2.1

F5 ≫ Big-ip Wan Optimization Manager Version 11.3.0

F5 ≫ Big-ip Application Acceleration Manager Version 11.4.0

F5 ≫ Big-ip Application Acceleration Manager Version 11.4.1

F5 ≫ Big-ip Application Acceleration Manager Version 11.5.0

F5 ≫ Big-ip Application Acceleration Manager Version 11.5.1

F5 ≫ Big-ip Application Acceleration Manager Version 11.6.0

F5 ≫ Big-ip Application Security Manager Version 10.0.0

F5 ≫ Big-ip Application Security Manager Version 10.1.0

F5 ≫ Big-ip Application Security Manager Version 10.2.0

F5 ≫ Big-ip Application Security Manager Version 10.2.1

F5 ≫ Big-ip Application Security Manager Version 10.2.2

F5 ≫ Big-ip Application Security Manager Version 10.2.3

F5 ≫ Big-ip Application Security Manager Version 10.2.4

F5 ≫ Big-ip Application Security Manager Version 11.0.0

F5 ≫ Big-ip Application Security Manager Version 11.1.0

F5 ≫ Big-ip Application Security Manager Version 11.2.0

F5 ≫ Big-ip Application Security Manager Version 11.2.1

F5 ≫ Big-ip Application Security Manager Version 11.3.0

F5 ≫ Big-ip Application Security Manager Version 11.4.0

F5 ≫ Big-ip Application Security Manager Version 11.4.1

F5 ≫ Big-ip Application Security Manager Version 11.5.0

F5 ≫ Big-ip Application Security Manager Version 11.5.1

F5 ≫ Big-ip Application Security Manager Version 11.6.0

F5 ≫ Big-ip Advanced Firewall Manager Version 11.3.0

F5 ≫ Big-ip Advanced Firewall Manager Version 11.4.0

F5 ≫ Big-ip Advanced Firewall Manager Version 11.4.1

F5 ≫ Big-ip Advanced Firewall Manager Version 11.5.0

F5 ≫ Big-ip Advanced Firewall Manager Version 11.5.1

F5 ≫ Big-ip Advanced Firewall Manager Version 11.6.0

F5 ≫ Big-ip Webaccelerator Version 10.0.0

F5 ≫ Big-ip Webaccelerator Version 10.1.0

F5 ≫ Big-ip Webaccelerator Version 10.2.0

F5 ≫ Big-ip Webaccelerator Version 10.2.1

F5 ≫ Big-ip Webaccelerator Version 10.2.2

F5 ≫ Big-ip Webaccelerator Version 10.2.3

F5 ≫ Big-ip Webaccelerator Version 10.2.4

F5 ≫ Big-ip Webaccelerator Version 11.0.0

F5 ≫ Big-ip Webaccelerator Version 11.1.0

F5 ≫ Big-ip Webaccelerator Version 11.2.0

F5 ≫ Big-ip Webaccelerator Version 11.2.1

F5 ≫ Big-ip Webaccelerator Version 11.3.0

F5 ≫ Big-ip Analytics Version 11.0.0

F5 ≫ Big-ip Analytics Version 11.1.0

F5 ≫ Big-ip Analytics Version 11.2.0

F5 ≫ Big-ip Analytics Version 11.2.1

F5 ≫ Big-ip Analytics Version 11.3.0

F5 ≫ Big-ip Analytics Version 11.4.0

F5 ≫ Big-ip Analytics Version 11.4.1

F5 ≫ Big-ip Analytics Version 11.5.0

F5 ≫ Big-ip Analytics Version 11.5.1

F5 ≫ Big-ip Analytics Version 11.6.0

F5 ≫ Big-ip Link Controller Version 10.0.0

F5 ≫ Big-ip Link Controller Version 10.1.0

F5 ≫ Big-ip Link Controller Version 10.2.0

F5 ≫ Big-ip Link Controller Version 10.2.1

F5 ≫ Big-ip Link Controller Version 10.2.2

F5 ≫ Big-ip Link Controller Version 10.2.3

F5 ≫ Big-ip Link Controller Version 10.2.4

F5 ≫ Big-ip Link Controller Version 11.0.0

F5 ≫ Big-ip Link Controller Version 11.1.0

F5 ≫ Big-ip Link Controller Version 11.2.0

F5 ≫ Big-ip Link Controller Version 11.2.1

F5 ≫ Big-ip Link Controller Version 11.3.0

F5 ≫ Big-ip Link Controller Version 11.4.0

F5 ≫ Big-ip Link Controller Version 11.4.1

F5 ≫ Big-ip Link Controller Version 11.5.0

F5 ≫ Big-ip Link Controller Version 11.5.1

F5 ≫ Big-ip Link Controller Version 11.6.0

F5 ≫ Big-ip Application Security Manager Version 10.0.0

F5 ≫ Big-ip Application Security Manager Version 10.1.0

F5 ≫ Big-ip Application Security Manager Version 10.2.0

F5 ≫ Big-ip Application Security Manager Version 10.2.1

F5 ≫ Big-ip Application Security Manager Version 10.2.2

F5 ≫ Big-ip Application Security Manager Version 10.2.3

F5 ≫ Big-ip Application Security Manager Version 10.2.4

F5 ≫ Big-ip Application Security Manager Version 11.0.0

F5 ≫ Big-ip Application Security Manager Version 11.1.0

F5 ≫ Big-ip Application Security Manager Version 11.2.0

F5 ≫ Big-ip Application Security Manager Version 11.2.1

F5 ≫ Big-ip Application Security Manager Version 11.3.0

F5 ≫ Big-ip Application Security Manager Version 11.4.0

F5 ≫ Big-ip Application Security Manager Version 11.4.1

F5 ≫ Big-ip Application Security Manager Version 11.5.0

F5 ≫ Big-ip Application Security Manager Version 11.5.1

F5 ≫ Big-ip Application Security Manager Version 11.6.0

F5 ≫ Enterprise Manager Version 3.0.0

F5 ≫ Enterprise Manager Version 3.1.0

F5 ≫ Enterprise Manager Version 3.1.1

F5 ≫ Enterprise Manager Version 2.1.0

F5 ≫ Enterprise Manager Version 2.2.0

F5 ≫ Enterprise Manager Version 2.3.0

F5 ≫ Big-ip Local Traffic Manager Version 10.0.0

F5 ≫ Big-ip Local Traffic Manager Version 10.1.0

F5 ≫ Big-ip Local Traffic Manager Version 10.2.0

F5 ≫ Big-ip Local Traffic Manager Version 10.2.1

F5 ≫ Big-ip Local Traffic Manager Version 10.2.2

F5 ≫ Big-ip Local Traffic Manager Version 10.2.3

F5 ≫ Big-ip Local Traffic Manager Version 10.2.4

F5 ≫ Big-ip Local Traffic Manager Version 11.0.0

F5 ≫ Big-ip Local Traffic Manager Version 11.1.0

F5 ≫ Big-ip Local Traffic Manager Version 11.2.0

F5 ≫ Big-ip Local Traffic Manager Version 11.2.1

F5 ≫ Big-ip Local Traffic Manager Version 11.3.0

F5 ≫ Big-ip Local Traffic Manager Version 11.4.0

F5 ≫ Big-ip Local Traffic Manager Version 11.4.1

F5 ≫ Big-ip Local Traffic Manager Version 11.5.0

F5 ≫ Big-ip Local Traffic Manager Version 11.5.1

F5 ≫ Big-ip Local Traffic Manager Version 11.6.0

F5 ≫ Big-ip Edge Gateway Version 10.1.0

F5 ≫ Big-ip Edge Gateway Version 10.2.0

F5 ≫ Big-ip Edge Gateway Version 10.2.1

F5 ≫ Big-ip Edge Gateway Version 10.2.2

F5 ≫ Big-ip Edge Gateway Version 10.2.3

F5 ≫ Big-ip Edge Gateway Version 10.2.4

F5 ≫ Big-ip Edge Gateway Version 11.0.0

F5 ≫ Big-ip Edge Gateway Version 11.1.0

F5 ≫ Big-ip Edge Gateway Version 11.2.0

F5 ≫ Big-ip Edge Gateway Version 11.2.1

F5 ≫ Big-ip Edge Gateway Version 11.3.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	2.9%	0.851

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5.5	8	4.9	AV:N/AC:L/Au:S/C:P/I:N/A:P

Es wurden noch keine Informationen zu CWE veröffentlicht.

http://packetstormsecurity.com/files/128915/F5-Big-IP-11.3.0.39.0-XML-External-Entity-Injection-1.html

Exploit

http://seclists.org/fulldisclosure/2014/Oct/128

http://seclists.org/fulldisclosure/2014/Oct/129

http://seclists.org/fulldisclosure/2014/Oct/130

http://www.securityfocus.com/bid/70834

Exploit

http://www.securitytracker.com/id/1031144

http://www.securitytracker.com/id/1031145

https://exchange.xforce.ibmcloud.com/vulnerabilities/98402

https://exchange.xforce.ibmcloud.com/vulnerabilities/98403

https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15605.html

Vendor Advisory

https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-6032/

https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-6033/

https://nvd.nist.gov/vuln/detail/CVE-2014-6032

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-6032

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-6032

EUVD