7.2

CVE-2018-5511

Exploit
On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Big-ip Local Traffic Manager Version 13.0.0
F5 ≫ Big-ip Local Traffic Manager Version 13.1.0
F5 ≫ Big-ip Analytics Version 13.0.0
F5 ≫ Big-ip Analytics Version 13.1.0
F5 ≫ Big-ip Access Policy Manager Version 13.0.0
F5 ≫ Big-ip Access Policy Manager Version 13.1.0
F5 ≫ Big-ip Edge Gateway Version 13.0.0
F5 ≫ Big-ip Edge Gateway Version 13.1.0
F5 ≫ Big-ip Global Traffic Manager Version 13.0.0
F5 ≫ Big-ip Global Traffic Manager Version 13.1.0
F5 ≫ Big-ip Link Controller Version 13.0.0
F5 ≫ Big-ip Link Controller Version 13.1.0
F5 ≫ Big-ip Webaccelerator Version 13.0.0
F5 ≫ Big-ip Webaccelerator Version 13.1.0
F5 ≫ Big-ip Websafe Version 13.0.0
F5 ≫ Big-ip Websafe Version 13.1.0
F5 ≫ Big-ip Domain Name System Version 13.0.0
F5 ≫ Big-ip Domain Name System Version 13.1.0
F5 ≫ Big-ip Enterprise Manager Version 3.1.1
VMware ≫ Workstation Version 14.1.5
VMware ≫ Workstation Player Version 15.0.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 14.47% 0.963
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 1.2 5.9
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NIST 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

http://packetstormsecurity.com/files/152213/VMware-Host-VMX-Process-Impersonation-Hijack-Privilege-Escalation.html
Third Party Advisory
VDB Entry
https://support.f5.com/csp/article/K30500703
Vendor Advisory
https://www.exploit-db.com/exploits/46600/
Third Party Advisory
Exploit
VDB Entry