CVE-2014-3220

Name of the Vulnerable Software and Affected Versions F5 BIG-IQ Cloud and Security versions 4.0.0 through 4.1.0

Description The issue allows remote authenticated users to change the password of arbitrary users. This is achieved by manipulating the name parameter in a request to the "mgmt/shared/authz/users/" API endpoint.

Recommendations For versions 4.0.0 through 4.1.0, consider restricting access to the "mgmt/shared/authz/users/" API endpoint to prevent unauthorized password changes until a fix is available. As a temporary workaround, avoid using the name parameter in requests to this endpoint.