title: BIG-IP Configuration utility vulnerability
description: A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
defaultStatus: unknown
modules: All Modules
product: BIG-IP
vendor: F5
versions:
lessThan: *, status: unaffected, version: 17.1.0, versionType: semver
lessThan: *, status: affected, version: 17.0.0, versionType: semver
lessThan: 16.1.3.4, status: affected, version: 16.1.0, versionType: semver
lessThan: 15.1.8.2, status: affected, version: 15.1.0, versionType: semver
lessThan: 14.1.5.4, status: affected, version: 14.1.0, versionType: semver
lessThan: *, status: affected, version: 13.1.0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL