CVE-2018-5511

Description

On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.

Weakness classification

• CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Primary references

• f5sirt@f5.com — Third Party Advisory, VDB Entry
• f5sirt@f5.com — Vendor Advisory
• f5sirt@f5.com — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry