CVE-2017-0301

In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources, however the application resources and backend servers are unaffected.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.6 HIGH
ADJACENT_NETWORK
HIGH
LOW
CVSS:3.0/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
f5CNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 35%
VendorProductVersion
f5big-ip_access_policy_manager
11.5.0
f5big-ip_access_policy_manager
11.5.1
f5big-ip_access_policy_manager
11.5.2
f5big-ip_access_policy_manager
11.5.3
f5big-ip_access_policy_manager
11.5.4
f5big-ip_access_policy_manager
11.6.0
f5big-ip_access_policy_manager
11.6.1
f5big-ip_access_policy_manager
12.0.0
f5big-ip_access_policy_manager
12.1.0
f5big-ip_access_policy_manager
12.1.1
f5big-ip_access_policy_manager
12.1.2
𝑥
= Vulnerable software versions
References
http://www.securitytracker.com/id/1040040
https://support.f5.com/csp/article/K54358225
http://www.securitytracker.com/id/1040040
https://support.f5.com/csp/article/K54358225