var-201405-0338
Vulnerability from variot
F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a request to the user's page in mgmt/shared/authz/users/. F5 Networks BIG-IQ is prone to a remote privilege-escalation vulnerability. Multiple F5 BIG-IQ products are prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization. Attackers can leverage this issue to bypass security restrictions and perform unauthorized actions; this may aid in launching further attacks. The following products are vulnerable: F5 BIG-IQ Cloud 4.0.0 through 4.1.0 are vulnerable. F5 BIG-IQ Security 4.0.0 through 4.1.0 are vulnerable. F5 BIG-IQ is a set of software-based cloud management solutions from F5 Corporation of the United States. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. The vulnerability is caused by the mgmt/shared/authz/users/ script not properly filtering the input submitted by the user
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201405-0338",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "big-iq",
"scope": "eq",
"trust": 2.4,
"vendor": "f5",
"version": "4.1.0.2013.0"
},
{
"model": "big-iq security",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.1"
},
{
"model": "big-iq security",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.0"
},
{
"model": "big-iq cloud",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.1"
},
{
"model": "big-iq cloud",
"scope": "eq",
"trust": 0.3,
"vendor": "f5",
"version": "4.0"
},
{
"model": "big-iq security",
"scope": "ne",
"trust": 0.3,
"vendor": "f5",
"version": "4.3"
},
{
"model": "big-iq security",
"scope": "ne",
"trust": 0.3,
"vendor": "f5",
"version": "4.2"
},
{
"model": "big-iq cloud",
"scope": "ne",
"trust": 0.3,
"vendor": "f5",
"version": "4.3"
},
{
"model": "big-iq cloud",
"scope": "ne",
"trust": 0.3,
"vendor": "f5",
"version": "4.2"
}
],
"sources": [
{
"db": "BID",
"id": "67227"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:f5:big-iq:4.1.0.2013.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-3220"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Brandon Perry",
"sources": [
{
"db": "BID",
"id": "67191"
}
],
"trust": 0.3
},
"cve": "CVE-2014-3220",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2014-3220",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "VHN-71159",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-3220",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201405-055",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-71159",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71159"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a request to the user\u0027s page in mgmt/shared/authz/users/. F5 Networks BIG-IQ is prone to a remote privilege-escalation vulnerability. Multiple F5 BIG-IQ products are prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization. \nAttackers can leverage this issue to bypass security restrictions and perform unauthorized actions; this may aid in launching further attacks. \nThe following products are vulnerable:\nF5 BIG-IQ Cloud 4.0.0 through 4.1.0 are vulnerable. \nF5 BIG-IQ Security 4.0.0 through 4.1.0 are vulnerable. F5 BIG-IQ is a set of software-based cloud management solutions from F5 Corporation of the United States. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. The vulnerability is caused by the mgmt/shared/authz/users/ script not properly filtering the input submitted by the user",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "BID",
"id": "67191"
},
{
"db": "BID",
"id": "67227"
},
{
"db": "VULHUB",
"id": "VHN-71159"
}
],
"trust": 2.25
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-71159",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71159"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-3220",
"trust": 3.1
},
{
"db": "BID",
"id": "67227",
"trust": 1.4
},
{
"db": "BID",
"id": "67191",
"trust": 1.4
},
{
"db": "EXPLOIT-DB",
"id": "33143",
"trust": 1.1
},
{
"db": "SECUNIA",
"id": "58440",
"trust": 1.1
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201405-055",
"trust": 0.7
},
{
"db": "FULLDISC",
"id": "20140502 RE: F5 BIG-IQ AUTHED ARBITRARY USER PASSWORD CHANGE",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20140501 F5 BIG-IQ AUTHED ARBITRARY USER PASSWORD CHANGE",
"trust": 0.6
},
{
"db": "SEEBUG",
"id": "SSVID-86389",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-71159",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71159"
},
{
"db": "BID",
"id": "67191"
},
{
"db": "BID",
"id": "67227"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"id": "VAR-201405-0338",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-71159"
}
],
"trust": 0.36666668
},
"last_update_date": "2023-12-18T12:45:21.360000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "BIG-IQ",
"trust": 0.8,
"url": "http://f5networks.co.jp/product/bigiq/index.html"
},
{
"title": "BIG-IQ-4.2.0.3208.0",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=49757"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71159"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "NVD",
"id": "CVE-2014-3220"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15229.html"
},
{
"trust": 1.7,
"url": "http://seclists.org/fulldisclosure/2014/may/10"
},
{
"trust": 1.7,
"url": "http://seclists.org/fulldisclosure/2014/may/11"
},
{
"trust": 1.7,
"url": "http://volatile-minds.blogspot.com/2014/05/f5-big-iq-v41020130-authenticated.html"
},
{
"trust": 1.7,
"url": "https://gist.github.com/brandonprry/2e73acd63094fa2a4f63"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/67191"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/67227"
},
{
"trust": 1.1,
"url": "http://www.exploit-db.com/exploits/33143"
},
{
"trust": 1.1,
"url": "http://seclists.org/fulldisclosure/2014/may/16"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/58440"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3220"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3220"
},
{
"trust": 0.8,
"url": "http://volatile-minds.blogspot.jp/2014/05/f5-big-iq-v41020130-authenticated.html"
},
{
"trust": 0.3,
"url": "http://support.f5.com/kb/en-us/solutions/public/4000/600/sol4602.html"
},
{
"trust": 0.3,
"url": "http://volatile-minds.blogspot.in/2014/05/f5-big-iq-v41020130-authenticated.html"
},
{
"trust": 0.3,
"url": "https://f5.com/products/big-iq"
},
{
"trust": 0.3,
"url": "https://f5.com/products/big-iq/big-iq-cloud"
},
{
"trust": 0.3,
"url": "https://f5.com/products/big-iq/big-iq-security"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71159"
},
{
"db": "BID",
"id": "67191"
},
{
"db": "BID",
"id": "67227"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-71159"
},
{
"db": "BID",
"id": "67191"
},
{
"db": "BID",
"id": "67227"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-05-05T00:00:00",
"db": "VULHUB",
"id": "VHN-71159"
},
{
"date": "2014-05-01T00:00:00",
"db": "BID",
"id": "67191"
},
{
"date": "2014-05-06T00:00:00",
"db": "BID",
"id": "67227"
},
{
"date": "2014-05-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"date": "2014-05-05T17:06:05.840000",
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"date": "2014-05-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-05-23T00:00:00",
"db": "VULHUB",
"id": "VHN-71159"
},
{
"date": "2015-03-19T09:34:00",
"db": "BID",
"id": "67191"
},
{
"date": "2015-04-13T21:01:00",
"db": "BID",
"id": "67227"
},
{
"date": "2014-05-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002390"
},
{
"date": "2014-05-23T04:08:27.570000",
"db": "NVD",
"id": "CVE-2014-3220"
},
{
"date": "2014-05-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "67191"
},
{
"db": "BID",
"id": "67227"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "F5 BIG-IQ Vulnerable to changing the password of an arbitrary user",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002390"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201405-055"
}
],
"trust": 0.6
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.