F5 Networks, Inc. BIG IP (Apm) vulnerabilities
19 vulnerabilities
Known vulnerabilities in F5 Networks, Inc. BIG IP (Apm), newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-5536f5 networks, inc.big-ip (apm)+1
EPSS score2.33%
A remote attacker via undisclosed measures, may be able to exploit an F5 BIG-IP APM 13.0.0-13.1.0.7 or 12.1.0-12.1.3.5 virtual server configured with an APM per-request policy object and cause a memory leak in the APM module.CVE-2018-5548f5 networks, inc.big-ip (apm)+1EPSS score1.44%
On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server configured with an access profile, allowing a malicious user to build a redirect URI value using different blocks of cipher texts.CVE-2018-5528f5 networks, inc.big-ip (apm)+1EPSS score1.20%
Under certain conditions, TMM may restart and produce a core file while processing APM data on BIG-IP 13.0.1 or 13.1.0.4-13.1.0.7.CVE-2018-5549f5 networks, inc.big-ip (apm)+1EPSS score1.78%
On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response containing certain elements.CVE-2018-5544f5 networks, inc.big-ip (apm)+1EPSS score2.43%
When the F5 BIG-IP APM 13.0.0-13.1.1 or 12.1.0-12.1.3 renders certain pages (pages with a logon agent or a confirm box), the BIG-IP APM may disclose configuration information such as partition and agent names via URI parameters.CVE-2018-15326f5 networks, inc.big-ip (apm)+1EPSS score0.55%
In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent may treat revoked certificates as valid when the BIG-IP APM system fails to download a new Certificate Revocation List.CVE-2018-15316f5 networks, inc.big-ip (apm)+5EPSS score0.59%
In F5 BIG-IP APM 13.0.0-13.1.1.1, APM Client 7.1.5-7.1.6, and/or Edge Client 7101-7160, the BIG-IP APM Edge Client component loads the policy library with user permission and bypassing the endpoint checks.CVE-2018-15324f5 networks, inc.big-ip (apm)+1EPSS score1.27%
On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access.CVE-2018-15334f5 networks, inc.big-ip (apm)+1EPSS score0.73%
A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM webtop session to log out and require re-authentication.CVE-2018-15335f5 networks, inc.big-ip (apm)+1EPSS score1.43%
When APM 13.0.0-13.1.x is deployed as an OAuth Resource Server, APM becomes a client application to an external OAuth authorization server. In certain cases when communication between the BIG-IP APM and the OAuth authorization server is lost, APM may not display the intended message in the failure responseCVE-2018-15310f5 networks, inc.big-ip (apm)+1EPSS score0.87%
A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritten pages.CVE-2016-9257f5 networks, inc.big-ip (apm)+1EPSS score0.78%
In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the context of the Administrative user when the Administrative user is viewing the Access System Logs, allowing the non-authenticated user to carry out a Cross Site Scripting (XSS) attack against the Administrative user.CVE-2017-0302f5 networks, inc.big-ip (apm)+1EPSS score0.74%
In F5 BIG-IP APM 12.0.0 through 12.1.2 and 13.0.0, an authenticated user with an established access session to the BIG-IP APM system may be able to cause a traffic disruption if the length of the requested URL is less than 16 characters.CVE-2017-0301f5 networks, inc.big-ip (apm)+1EPSS score0.53%
In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources, however the application resources and backend servers are unaffected.CVE-2017-6139f5 networks, inc.big-ip (apm)+1EPSS score1.70%
In F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system appends log details when responding to client requests. Details in the log file can vary; customers running debug mode logging with BIG-IP APM are at highest risk.CVE-2017-6129f5 networks, inc.big-ip (apm)+1EPSS score1.64%
In F5 BIG-IP APM software version 13.0.0 and 12.1.2, in some circumstances, APM tunneled VPN flows can cause a VPN/PPP connflow to be prematurely freed or cause TMM to stop responding with a "flow not in use" assertion. An attacker may be able to disrupt traffic or cause the BIG-IP system to fail over to another device in the device group.CVE-2019-6596f5 networks, inc.big-ip (apm)+1EPSS score1.38%
In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, 12.1.0-12.1.3.6, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when processing fragmented ClientHello messages in a DTLS session TMM may corrupt memory eventually leading to a crash. Only systems offering DTLS connections via APM are impacted.CVE-2019-6595f5 networks, inc.big-ip (apm)+1EPSS score0.92%
Cross-site scripting (XSS) vulnerability in F5 BIG-IP Access Policy Manager (APM) 11.5.x and 11.6.x Admin Web UI.CVE-2019-6591f5 networks, inc.big-ip (apm)+1EPSS score0.62%
On BIG-IP APM 14.0.0 to 14.0.0.4, 13.0.0 to 13.1.1.3 and 12.1.0 to 12.1.3.7, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system.