CVE-2018-15333 Missing authorization in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)

Medium 5.5 Published 28 Dec 2018 Updated 5 Aug 2024

Any authenticated user, including guests, can download sensitive snapshot files like QKView and TCPDumps from the BIG-IP configuration utility.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-15333?

CVE-2018-15333 is a medium-severity missing authorization vulnerability in F5 Big-Ip Access Policy Manager, published on 28 Dec 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

On versions 11.2.1. and greater, unrestricted Snapshot File Access allows BIG-IP system's user with any role, including Guest Role, to have access and download previously generated and available snapshot files on the BIG-IP configuration utility such as QKView and TCPDumps.

Weakness: CWE-434

Which versions are affected by CVE-2018-15333?

It affects 13 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager, F5 Big-Ip Domain Name System and 7 more.

How do I fix CVE-2018-15333?

No fix has been published for CVE-2018-15333 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-15333 being exploited?

There is no known exploitation of CVE-2018-15333 in the wild and no public exploit code.

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

Also known as GHSA-hh2c-99xr-8r5r.