CVE-2018-5519 Path traversal in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, WebSafe)

Medium 4.9 Published 2 May 2018 Updated 16 Sep 2024

Administrative users can exploit ssldump to write to arbitrary file paths, bypassing intended file access restrictions in Appliance Mode.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-5519?

CVE-2018-5519 is a medium-severity path traversal vulnerability in F5 Big-Ip Access Policy Manager, published on 2 May 2018. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.3, or 11.2.1-11.6.3.1, administrative users by way of undisclosed methods can exploit the ssldump utility to write to arbitrary file paths. For users who do not have Advanced Shell access (for example, any user when licensed for Appliance Mode), this allows more permissive file access than intended.

Which versions are affected by CVE-2018-5519?

It affects 13 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager, F5 Big-Ip Domain Name System and 7 more.

How do I fix CVE-2018-5519?

No fix has been published for CVE-2018-5519 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2018-5519 being exploited?

There is no known exploitation of CVE-2018-5519 in the wild and no public exploit code.

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

Also known as GHSA-jqvf-wwmr-gpq9.