6.5
CVSSv2

CVE-2018-5511

Published: 13/04/2018 Updated: 03/10/2019
CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8
CVSS v3 Base Score: 7.2 | Impact Score: 5.9 | Exploitability Score: 1.2
VMScore: 655
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Vulnerability Summary

On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.

Vulnerable Product Search on Vulmon Subscribe to Product

f5 big-ip local traffic manager 13.1.0

f5 big-ip local traffic manager 13.0.0

f5 big-ip application acceleration manager 13.1.0

f5 big-ip application acceleration manager 13.0.0

f5 big-ip advanced firewall manager 13.0.0

f5 big-ip advanced firewall manager 13.1.0

f5 big-ip analytics 13.1.0

f5 big-ip analytics 13.0.0

f5 big-ip access policy manager 13.1.0

f5 big-ip access policy manager 13.0.0

f5 big-ip application security manager 13.0.0

f5 big-ip application security manager 13.1.0

f5 big-ip edge gateway 13.1.0

f5 big-ip edge gateway 13.0.0

f5 big-ip global traffic manager 13.1.0

f5 big-ip global traffic manager 13.0.0

f5 big-ip link controller 13.1.0

f5 big-ip link controller 13.0.0

f5 big-ip policy enforcement manager 13.1.0

f5 big-ip policy enforcement manager 13.0.0

f5 big-ip webaccelerator 13.1.0

f5 big-ip webaccelerator 13.0.0

f5 big-ip websafe 13.1.0

f5 big-ip websafe 13.0.0

f5 big-ip domain name system 13.1.0

f5 big-ip domain name system 13.0.0

f5 big-ip enterprise manager 3.1.1

vmware workstation 14.1.5

vmware workstation player 15.0.2

Exploits

VMware: Host VMX Process Impersonation Hijack EoP Platform: VMware Workstation Windows v1415 (on Windows 10) Also tested VMware Player 1502 Class: Elevation of Privilege Summary: The creation of the VMX process on a Windows host can be hijacked leading to elevation of privilege Description: The VMX process (vmware-vmxexe) process configur ...