PT-2014-2261
CVE-2012-3000
·
تاريخ النشر
2014-01-30
·
تاريخ التحديث
2017-08-29
الوصف من
CVSS 2.0
7.5
عاليةالمقاييسAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
F5 BIG-IP LTM, GTM, ASM, Link Controller, PSM, APM, Edge Gateway, and Analytics versions prior to 11.2.0-HF3
F5 WebAccelerator and WOM versions prior to 11.2.0-HF3 and prior to 11.2.1-HF3
Description
The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the
defaultQuery parameter in the sam/admin/reports/php/saveSettings.php file of the APM WebGUI and AVR WebGUI.Recommendations
For F5 BIG-IP LTM, GTM, ASM, Link Controller, PSM, APM, Edge Gateway, and Analytics versions prior to 11.2.0-HF3, update to version 11.2.0-HF3 or later.
For F5 WebAccelerator and WOM versions prior to 11.2.0-HF3, update to version 11.2.0-HF3 or later.
For F5 WebAccelerator and WOM versions prior to 11.2.1-HF3, update to version 11.2.1-HF3 or later.
As a temporary workaround, consider restricting access to the
defaultQuery parameter in the affected API endpoint until a patch is available. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾