CVE-2022-29263 (GCVE-0-2022-29263)

Vulnerability from cvelistv5 – Published: 2022-05-05 16:43 – Updated: 2024-09-16 23:27
VLAI?
Summary
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component Installer Service does not use best practice while saving temporary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
f5
References
Impacted products
Vendor Product Version
F5 BIG-IP APM Affected: 12.1.x
Affected: 11.6.x
Unaffected: 17.0.0 , < 17.0.x* (custom)
Affected: 16.1.x , < 16.1.2.2 (custom)
Affected: 15.1.x , < 15.1.5.1 (custom)
Affected: 14.1.x , < 14.1.4.6 (custom)
Affected: 13.1.x , < 13.1.5 (custom)
Create a notification for this product.
    F5 BIG-IP APM Clients Affected: 7.x , < 7.2.1.5 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:17:54.512Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K33552735"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BIG-IP APM",
          "vendor": "F5",
          "versions": [
            {
              "status": "affected",
              "version": "12.1.x"
            },
            {
              "status": "affected",
              "version": "11.6.x"
            },
            {
              "lessThan": "17.0.x*",
              "status": "unaffected",
              "version": "17.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "16.1.2.2",
              "status": "affected",
              "version": "16.1.x",
              "versionType": "custom"
            },
            {
              "lessThan": "15.1.5.1",
              "status": "affected",
              "version": "15.1.x",
              "versionType": "custom"
            },
            {
              "lessThan": "14.1.4.6",
              "status": "affected",
              "version": "14.1.x",
              "versionType": "custom"
            },
            {
              "lessThan": "13.1.5",
              "status": "affected",
              "version": "13.1.x",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "BIG-IP APM Clients",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "7.2.1.5",
              "status": "affected",
              "version": "7.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2022-05-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component Installer Service does not use best practice while saving temporary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-05T16:43:25",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.f5.com/csp/article/K33552735"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "f5sirt@f5.com",
          "DATE_PUBLIC": "2022-05-04T14:00:00.000Z",
          "ID": "CVE-2022-29263",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BIG-IP APM",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "!\u003e=",
                            "version_name": "17.0.x",
                            "version_value": "17.0.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "16.1.x",
                            "version_value": "16.1.2.2"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "15.1.x",
                            "version_value": "15.1.5.1"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "14.1.x",
                            "version_value": "14.1.4.6"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "13.1.x",
                            "version_value": "13.1.5"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "12.1.x",
                            "version_value": "12.1.x"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "11.6.x",
                            "version_value": "11.6.x"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "BIG-IP APM Clients",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "7.x",
                            "version_value": "7.2.1.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "F5"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component Installer Service does not use best practice while saving temporary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-732 Incorrect Permission Assignment for Critical Resource"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.f5.com/csp/article/K33552735",
              "refsource": "MISC",
              "url": "https://support.f5.com/csp/article/K33552735"
            }
          ]
        },
        "source": {
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2022-29263",
    "datePublished": "2022-05-05T16:43:25.102294Z",
    "dateReserved": "2022-04-19T00:00:00",
    "dateUpdated": "2024-09-16T23:27:04.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:access_policy_manager_clients:7.1.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1686A08A-BBBA-463C-A476-ACCD1E1569EA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:access_policy_manager_clients:7.1.8.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9BF39955-D839-4589-98FB-269B800F48D0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:access_policy_manager_clients:7.1.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4ABC03E5-BF12-476B-AFBE-E31CFE980D2F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:access_policy_manager_clients:7.1.9.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"66762F6E-05DE-4E27-8FAA-64F6BBE96D33\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:access_policy_manager_clients:7.1.9.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEDFFC02-B7F2-45BE-BA50-2F1665FAE123\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:access_policy_manager_clients:7.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A86C18E4-D4E5-49C1-ABFC-0F17800F24A7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:access_policy_manager_clients:7.2.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"498E2272-7684-457E-B6D1-ACB13924C8DC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E33BCA5B-CE91-451C-9821-2023A9E461C1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9DEE8658-1C3C-4245-960B-C0EA5A6843AA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D7461621-52A4-46AF-AD61-651CEF43DF29\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2D9EE524-2CA9-4252-8BC6-0C438C27AA5D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C9F1AB0A-F56D-4154-A992-D4EE722E0922\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FCD2044C-AC6F-4145-B1A0-8EB26DCF1F8C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5FC866D4-CE8C-4408-AD1E-8643AC554CC9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7563D979-BE37-4251-B92E-0DBDBE53F3FF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"846E0609-BDD4-4B55-AC35-325D437CE2B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"35ADE9D3-F6FF-4418-83B6-42896B200CA9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1D8503D6-43CC-436E-A9DB-EC99C3E79C43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C6781DA7-9577-4FDE-8170-CC8DD90BD1AA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5491BC3C-EE0C-43FA-B870-BBF9FC4FADB2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"41408E51-04CC-4208-9DBA-0A5A90EFC7A7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C90F3BA6-6466-48C5-A621-B44549419496\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"79A3A605-EBE9-4C50-B6F4-5FBD385FA8B2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B3E688B1-28C4-4F9A-9474-381FD22E792D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"25DAD24A-2D43-498E-BC43-183B669EA1FD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B25A33B9-2485-4D80-8F49-9B4688A39345\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2D3E81E7-3E6A-46AD-827D-14046D93144E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C9416AE8-7C48-4986-99E8-5F313715B6B2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DCA6CE41-1D13-4A7A-94D8-C0D5740870A6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"29041413-B405-42A6-B9E9-A3E7C3AC1CB9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9F0C4673-2F1D-45B6-BC18-83EF68BA3601\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0148360C-1167-4FF9-B231-3D53890BD932\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"214D3CD8-6A1A-4119-B107-0363D34B3458\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6CA06267-4A87-4249-8A08-5A78BDCEE884\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:16.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EF96CE38-E834-475C-92AD-97D904D8F831\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:16.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"702ACADF-C7FF-43C9-89A9-5F464718F800\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:16.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C7E9747B-6167-4E8B-AF48-AA55C900C872\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:17.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AD637AF5-F7D1-428F-955E-16756B7476E0\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component Installer Service does not use best practice while saving temporary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated\"}, {\"lang\": \"es\", \"value\": \"En F5 BIG-IP APM versiones 16.1.x anteriores a 16.1.2.2, las versiones 15.1.x anteriores a 15.1.5.1, las versiones 14.1.x anteriores a 14.1.4.6, las versiones 13.1.x anteriores a 13.1.5 y todas las versiones de 12.1 x y 11.6.x, as\\u00ed como las versiones de F5 BIG-IP APM Clients 7.x anteriores a 7.2.1.5, el servicio de instalaci\\u00f3n de componentes de BIG-IP Edge Client no usa las mejores pr\\u00e1cticas mientras guarda los archivos temporales. Nota: Las versiones de software que han alcanzado el Fin del Soporte T\\u00e9cnico (EoTS) no son evaluadas\"}]",
      "id": "CVE-2022-29263",
      "lastModified": "2024-11-21T06:58:49.760",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"f5sirt@f5.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 4.6, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 3.9, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2022-05-05T17:15:14.910",
      "references": "[{\"url\": \"https://support.f5.com/csp/article/K33552735\", \"source\": \"f5sirt@f5.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://support.f5.com/csp/article/K33552735\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "f5sirt@f5.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"f5sirt@f5.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-732\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-29263\",\"sourceIdentifier\":\"f5sirt@f5.com\",\"published\":\"2022-05-05T17:15:14.910\",\"lastModified\":\"2024-11-21T06:58:49.760\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component Installer Service does not use best practice while saving temporary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated\"},{\"lang\":\"es\",\"value\":\"En F5 BIG-IP APM versiones 16.1.x anteriores a 16.1.2.2, las versiones 15.1.x anteriores a 15.1.5.1, las versiones 14.1.x anteriores a 14.1.4.6, las versiones 13.1.x anteriores a 13.1.5 y todas las versiones de 12.1 x y 11.6.x, as\u00ed como las versiones de F5 BIG-IP APM Clients 7.x anteriores a 7.2.1.5, el servicio de instalaci\u00f3n de componentes de BIG-IP Edge Client no usa las mejores pr\u00e1cticas mientras guarda los archivos temporales. Nota: Las versiones de software que han alcanzado el Fin del Soporte T\u00e9cnico (EoTS) no son evaluadas\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"f5sirt@f5.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"f5sirt@f5.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:access_policy_manager_clients:7.1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1686A08A-BBBA-463C-A476-ACCD1E1569EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:access_policy_manager_clients:7.1.8.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BF39955-D839-4589-98FB-269B800F48D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:access_policy_manager_clients:7.1.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4ABC03E5-BF12-476B-AFBE-E31CFE980D2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:access_policy_manager_clients:7.1.9.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"66762F6E-05DE-4E27-8FAA-64F6BBE96D33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:access_policy_manager_clients:7.1.9.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEDFFC02-B7F2-45BE-BA50-2F1665FAE123\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:access_policy_manager_clients:7.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A86C18E4-D4E5-49C1-ABFC-0F17800F24A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:access_policy_manager_clients:7.2.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"498E2272-7684-457E-B6D1-ACB13924C8DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E33BCA5B-CE91-451C-9821-2023A9E461C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9DEE8658-1C3C-4245-960B-C0EA5A6843AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7461621-52A4-46AF-AD61-651CEF43DF29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D9EE524-2CA9-4252-8BC6-0C438C27AA5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9F1AB0A-F56D-4154-A992-D4EE722E0922\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FCD2044C-AC6F-4145-B1A0-8EB26DCF1F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FC866D4-CE8C-4408-AD1E-8643AC554CC9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7563D979-BE37-4251-B92E-0DBDBE53F3FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"846E0609-BDD4-4B55-AC35-325D437CE2B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"35ADE9D3-F6FF-4418-83B6-42896B200CA9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D8503D6-43CC-436E-A9DB-EC99C3E79C43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6781DA7-9577-4FDE-8170-CC8DD90BD1AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5491BC3C-EE0C-43FA-B870-BBF9FC4FADB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41408E51-04CC-4208-9DBA-0A5A90EFC7A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C90F3BA6-6466-48C5-A621-B44549419496\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"79A3A605-EBE9-4C50-B6F4-5FBD385FA8B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3E688B1-28C4-4F9A-9474-381FD22E792D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25DAD24A-2D43-498E-BC43-183B669EA1FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B25A33B9-2485-4D80-8F49-9B4688A39345\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D3E81E7-3E6A-46AD-827D-14046D93144E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9416AE8-7C48-4986-99E8-5F313715B6B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCA6CE41-1D13-4A7A-94D8-C0D5740870A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"29041413-B405-42A6-B9E9-A3E7C3AC1CB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F0C4673-2F1D-45B6-BC18-83EF68BA3601\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0148360C-1167-4FF9-B231-3D53890BD932\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"214D3CD8-6A1A-4119-B107-0363D34B3458\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6CA06267-4A87-4249-8A08-5A78BDCEE884\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:16.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF96CE38-E834-475C-92AD-97D904D8F831\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:16.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"702ACADF-C7FF-43C9-89A9-5F464718F800\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:16.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C7E9747B-6167-4E8B-AF48-AA55C900C872\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:17.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD637AF5-F7D1-428F-955E-16756B7476E0\"}]}]}],\"references\":[{\"url\":\"https://support.f5.com/csp/article/K33552735\",\"source\":\"f5sirt@f5.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://support.f5.com/csp/article/K33552735\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.