NVD Vulnerability Detail

CVE-2014-8727

Summary	Multiple directory traversal vulnerabilities in F5 BIG-IP before 10.2.2 allow local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrary files via a .. (dot dot) in the name parameter to (1) tmui/Control/jspmap/tmui/system/archive/properties.jsp or (2) tmui/Control/form.
Publication Date	Nov. 18, 2014, 1:59 a.m.
Registration Date	Jan. 26, 2021, 3:21 p.m.
Last Update	Nov. 21, 2024, 11:19 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_local_traffic_manager::::::::			10.2.1

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/129084/F5-BIG-IP-10.1.0-Directory-Traversal.html	Exploit
2	http://packetstormsecurity.com/files/129084/F5-BIG-IP-10.1.0-Directory-Traversal.html	Exploit
3	http://www.exploit-db.com/exploits/35222	Exploit
4	http://www.exploit-db.com/exploits/35222	Exploit
5	http://www.securityfocus.com/bid/71063
6	http://www.securityfocus.com/bid/71063
7	http://www.securitytracker.com/id/1031216
8	http://www.securitytracker.com/id/1031216
9	https://exchange.xforce.ibmcloud.com/vulnerabilities/98676
10	https://exchange.xforce.ibmcloud.com/vulnerabilities/98676
11	https://support.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/product/relnote_11_0_0_ltm.html
12	https://support.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/product/relnote_11_0_0_ltm.html
13	https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13109.html	Vendor Advisory
14	https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13109.html	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

F5 BIG-IP におけるディレクトリトラバーサルの脆弱性

Title	F5 BIG-IP におけるディレクトリトラバーサルの脆弱性
Summary	F5 BIG-IP には、ディレクトリトラバーサルの脆弱性が存在します。
Possible impacts	リソースの管理者または管理者のロールを持つローカルユーザにより、.. (ドットドット) を含む (1) tmui/Control/jspmap/tmui/system/archive/properties.jsp または (2) tmui/Control/form の name パラメータを介して、任意のファイルを列挙される、および削除される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 16, 2014, midnight
Registration Date	Nov. 19, 2014, 10:58 a.m.
Last Update	Nov. 19, 2014, 10:58 a.m.

Affected System

F5 Networks

BIG-IP Local Traffic Manager (LTM) 10.2.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-8727	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8727
National Vulnerability Database (NVD)
2	CVE-2014-8727	https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8727

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
F5 Networks
1	Release Note: BIG-IP LTM and TMOS version 11.0.0	https://support.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/product/relnote_11_0_0_ltm.html
2	sol13109: Overview of BIG-IP version 10.2.2 cumulative hotfixes	https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13109.html

Change Log

No	Changed Details	Date of change
0	[2014年11月19日] 掲載	Feb. 17, 2018, 10:37 a.m.