VAR-201405-0338
Vulnerability from variot - Updated: 2023-12-18 12:45F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a request to the user's page in mgmt/shared/authz/users/. F5 Networks BIG-IQ is prone to a remote privilege-escalation vulnerability. Multiple F5 BIG-IQ products are prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization. Attackers can leverage this issue to bypass security restrictions and perform unauthorized actions; this may aid in launching further attacks. The following products are vulnerable: F5 BIG-IQ Cloud 4.0.0 through 4.1.0 are vulnerable. F5 BIG-IQ Security 4.0.0 through 4.1.0 are vulnerable. F5 BIG-IQ is a set of software-based cloud management solutions from F5 Corporation of the United States. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. The vulnerability is caused by the mgmt/shared/authz/users/ script not properly filtering the input submitted by the user
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201405-0338",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "big-iq",
"scope": "eq",
"trust": 2.4,
"vendor": "f5",
"version": "4.1.0.2013.0"
},
{
"model": "big-iq security",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.1"
},
{
"model": "big-iq security",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.0"
},
{
"model": "big-iq cloud",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.1"
},
{
"model": "big-iq cloud",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.0"
},
{
"model": "big-iq security",
"scope": "ne",
"trust": 0.3,
"vendor": "f5",
"version": "4.3"
},
{
"model": "big-iq security",
"scope": "ne",
"trust": 0.3,
"vendor": "f5",
"version": "4.2"
},
{
"model": "big-iq cloud",
"scope": "ne",
"trust": 0.3,
"vendor": "f5",
"version": "4.3"
},
{
"model": "big-iq cloud",
"scope": "ne",
"trust": 0.3,
"vendor": "f5",
"version": "4.2"
}
],
"sources": [
{
"db": "BID",
"id": "67227"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:f5:big-iq:4.1.0.2013.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-3220"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Brandon Perry",
"sources": [
{
"db": "BID",
"id": "67191"
}
],
"trust": 0.3
},
"cve": "CVE-2014-3220",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2014-3220",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "VHN-71159",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-3220",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201405-055",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-71159",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71159"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a request to the user\u0027s page in mgmt/shared/authz/users/. F5 Networks BIG-IQ is prone to a remote privilege-escalation vulnerability. Multiple F5 BIG-IQ products are prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization. \nAttackers can leverage this issue to bypass security restrictions and perform unauthorized actions; this may aid in launching further attacks. \nThe following products are vulnerable:\nF5 BIG-IQ Cloud 4.0.0 through 4.1.0 are vulnerable. \nF5 BIG-IQ Security 4.0.0 through 4.1.0 are vulnerable. F5 BIG-IQ is a set of software-based cloud management solutions from F5 Corporation of the United States. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. The vulnerability is caused by the mgmt/shared/authz/users/ script not properly filtering the input submitted by the user",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "BID",
"id": "67191"
},
{
"db": "BID",
"id": "67227"
},
{
"db": "VULHUB",
"id": "VHN-71159"
}
],
"trust": 2.25
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-71159",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71159"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-3220",
"trust": 3.1
},
{
"db": "BID",
"id": "67227",
"trust": 1.4
},
{
"db": "BID",
"id": "67191",
"trust": 1.4
},
{
"db": "EXPLOIT-DB",
"id": "33143",
"trust": 1.1
},
{
"db": "SECUNIA",
"id": "58440",
"trust": 1.1
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201405-055",
"trust": 0.7
},
{
"db": "FULLDISC",
"id": "20140502 RE: F5 BIG-IQ AUTHED ARBITRARY USER PASSWORD CHANGE",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20140501 F5 BIG-IQ AUTHED ARBITRARY USER PASSWORD CHANGE",
"trust": 0.6
},
{
"db": "SEEBUG",
"id": "SSVID-86389",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-71159",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71159"
},
{
"db": "BID",
"id": "67191"
},
{
"db": "BID",
"id": "67227"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"id": "VAR-201405-0338",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-71159"
}
],
"trust": 0.36666668
},
"last_update_date": "2023-12-18T12:45:21.360000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "BIG-IQ",
"trust": 0.8,
"url": "http://f5networks.co.jp/product/bigiq/index.html"
},
{
"title": "BIG-IQ-4.2.0.3208.0",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=49757"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71159"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "NVD",
"id": "CVE-2014-3220"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15229.html"
},
{
"trust": 1.7,
"url": "http://seclists.org/fulldisclosure/2014/may/10"
},
{
"trust": 1.7,
"url": "http://seclists.org/fulldisclosure/2014/may/11"
},
{
"trust": 1.7,
"url": "http://volatile-minds.blogspot.com/2014/05/f5-big-iq-v41020130-authenticated.html"
},
{
"trust": 1.7,
"url": "https://gist.github.com/brandonprry/2e73acd63094fa2a4f63"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/67191"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/67227"
},
{
"trust": 1.1,
"url": "http://www.exploit-db.com/exploits/33143"
},
{
"trust": 1.1,
"url": "http://seclists.org/fulldisclosure/2014/may/16"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/58440"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3220"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3220"
},
{
"trust": 0.8,
"url": "http://volatile-minds.blogspot.jp/2014/05/f5-big-iq-v41020130-authenticated.html"
},
{
"trust": 0.3,
"url": "http://support.f5.com/kb/en-us/solutions/public/4000/600/sol4602.html"
},
{
"trust": 0.3,
"url": "http://volatile-minds.blogspot.in/2014/05/f5-big-iq-v41020130-authenticated.html"
},
{
"trust": 0.3,
"url": "https://f5.com/products/big-iq"
},
{
"trust": 0.3,
"url": "https://f5.com/products/big-iq/big-iq-cloud"
},
{
"trust": 0.3,
"url": "https://f5.com/products/big-iq/big-iq-security"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71159"
},
{
"db": "BID",
"id": "67191"
},
{
"db": "BID",
"id": "67227"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-71159"
},
{
"db": "BID",
"id": "67191"
},
{
"db": "BID",
"id": "67227"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-05-05T00:00:00",
"db": "VULHUB",
"id": "VHN-71159"
},
{
"date": "2014-05-01T00:00:00",
"db": "BID",
"id": "67191"
},
{
"date": "2014-05-06T00:00:00",
"db": "BID",
"id": "67227"
},
{
"date": "2014-05-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"date": "2014-05-05T17:06:05.840000",
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"date": "2014-05-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-05-23T00:00:00",
"db": "VULHUB",
"id": "VHN-71159"
},
{
"date": "2015-03-19T09:34:00",
"db": "BID",
"id": "67191"
},
{
"date": "2015-04-13T21:01:00",
"db": "BID",
"id": "67227"
},
{
"date": "2014-05-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"date": "2014-05-23T04:08:27.570000",
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"date": "2014-05-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "67191"
},
{
"db": "BID",
"id": "67227"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "F5 BIG-IQ Vulnerable to changing the password of an arbitrary user",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…