CVE-2008-6474: f5 tmos Code Injection

Vulnerability summary

CVE-2008-6474 is a high (CVSS 9.0) Code Injection vulnerability in f5 tmos. EPSS estimates a 2.71% chance of exploitation in the next 30 days, higher than 85.7% of scored vulnerabilities.

Timeline

1. 16-03-2009
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

The management interface in F5 BIG-IP 9.4.3 allows remote authenticated users with Resource Manager privileges to inject arbitrary Perl code via unspecified configuration settings related to Perl EP3 with templates, probably triggering static code injection.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.