CVE-2014-8727 Path traversal in n/a

What is CVE-2014-8727?

CVE-2014-8727 is a medium-severity path traversal vulnerability in F5 Big-Ip Local Traffic Manager, published on 17 Nov 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Multiple directory traversal vulnerabilities in F5 BIG-IP before 10.2.2 allow local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrary files via a .. (dot dot) in the name parameter to (1) tmui/Control/jspmap/tmui/system/archive/properties.jsp or (2) tmui/Control/form.

Weakness: CWE-22

Which versions are affected by CVE-2014-8727?

It affects 1 product.

Products include F5 Big-Ip Local Traffic Manager.

How do I fix CVE-2014-8727?

No fix has been published for CVE-2014-8727 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2014-8727 being exploited?

There is no known exploitation of CVE-2014-8727 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in F5 Big-Ip Local Traffic Manager

• CVE-2016-5745 Missing authorization in n/a Critical 9.8
• CVE-2020-5936 Denial of service in BIG-IP LTM High 7.5
• CVE-2019-6681 Denial of service in BIG-IP High 7.5
• CVE-2018-17539 Denial of service in n/a High 7.5
• CVE-2019-6590 Denial of service in BIG-IP (LTM) Medium 5.9

All F5 Big-Ip Local Traffic Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-598q-2q8q-vp87.