CVE-2013-0150: Path Traversal
First published: Fri Aug 09 2013(Updated: )
Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass 6.0.0 through 6.1.0 and 7.0.0, and other products "when APM is provisioned," allows remote attackers to upload and execute arbitrary files via a .. (dot dot) in the filename parameter.
Credit: cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| F5 Access Policy Manager | =10.1.0 | |
| F5 Access Policy Manager | =10.2.4 | |
| F5 Access Policy Manager | =11.0.0 | |
| F5 Access Policy Manager | =11.3.0 | |
| F5 Access Policy Manager | =10.1.0 | |
| F5 Access Policy Manager | =10.2.4 | |
| F5 Access Policy Manager | =11.0.0 | |
| F5 Access Policy Manager | =11.3.0 | |
| F5 FirePass SSL VPN | =6.0 | |
| F5 FirePass SSL VPN | =6.1.0 | |
| F5 FirePass SSL VPN | =7.0.0 | |
| F5 Access Policy Manager | >=10.1.0<=10.2.4 | |
| F5 Access Policy Manager | >=11.0.0<=11.3.0 | |
| F5 BIG-IP Advanced Firewall Manager | =11.3.0 | |
| F5 BIG-IP Analytics | >=11.0.0<=11.3.0 | |
| F5 Application Security Manager | >=10.1.0<=10.2.4 | |
| F5 Application Security Manager | >=11.0.0<=11.3.0 | |
| F5 BIG-IP Edge Gateway | >=10.1.0<=10.2.4 | |
| F5 BIG-IP Edge Gateway | >=11.0.0<=11.3.0 | |
| Riverbed SteelApp Traffic Manager | >=10.1.0<=10.2.4 | |
| Riverbed SteelApp Traffic Manager | >=11.0.0<=11.3.0 | |
| F5 BIG-IP Link Controller | >=10.1.0<=10.2.4 | |
| F5 BIG-IP Link Controller | >=11.0.0<=11.3.0 | |
| Riverbed SteelApp Traffic Manager | >=10.1.0<=10.2.4 | |
| Riverbed SteelApp Traffic Manager | >=11.0.0<=11.3.0 | |
| F5 BIG-IP Policy Enforcement Manager | =11.3.0 | |
| F5 BIG-IP Protocol Security Manager | >=10.1.0<=10.2.4 | |
| F5 BIG-IP Protocol Security Manager | >=11.0.0<=11.3.0 | |
| Exinda WAN Optimization Suite | >=10.1.0<=10.2.4 | |
| Exinda WAN Optimization Suite | >=11.0.0<=11.3.0 | |
| F5 BIG-IP WebAccelerator | >=10.1.0<=10.2.4 | |
| F5 BIG-IP WebAccelerator | >=11.0.0<=11.3.0 | |
| F5 FirePass SSL VPN | >=6.0.0<=6.1.0 | |
| F5 FirePass SSL VPN | =7.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-0150?
CVE-2013-0150 has a medium severity rating due to the potential for remote code execution and unauthorized access.
How do I fix CVE-2013-0150?
To fix CVE-2013-0150, upgrade the affected F5 software to a more secure version that addresses this vulnerability.
Which versions of F5 products are affected by CVE-2013-0150?
CVE-2013-0150 affects F5 BIG-IP APM versions 10.1.0 to 10.2.4 and 11.0.0 to 11.3.0, as well as FirePass versions 6.0.0 to 7.0.0.
What type of vulnerability is CVE-2013-0150?
CVE-2013-0150 is classified as a directory traversal vulnerability within signed Java applets.
Can CVE-2013-0150 lead to data loss?
Yes, CVE-2013-0150 can potentially lead to data loss by allowing attackers to execute unauthorized commands on the affected system.
- agent/type
- agent/references
- agent/weakness
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/author
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- agent/softwarecombine
- agent/tags
- vendor/f5
- canonical/f5 access policy manager
- version/f5 access policy manager/10.1.0
- version/f5 access policy manager/10.2.4
- version/f5 access policy manager/11.0.0
- version/f5 access policy manager/11.3.0
- canonical/f5 firepass ssl vpn
- version/f5 firepass ssl vpn/6.0
- version/f5 firepass ssl vpn/6.1.0
- version/f5 firepass ssl vpn/7.0.0
- canonical/f5 big-ip advanced firewall manager
- version/f5 big-ip advanced firewall manager/11.3.0
- canonical/f5 big-ip analytics
- version/f5 big-ip analytics/11.0.0
- version/f5 big-ip analytics/11.3.0
- canonical/f5 application security manager
- version/f5 application security manager/10.1.0
- version/f5 application security manager/10.2.4
- version/f5 application security manager/11.0.0
- version/f5 application security manager/11.3.0
- canonical/f5 big-ip edge gateway
- version/f5 big-ip edge gateway/10.1.0
- version/f5 big-ip edge gateway/10.2.4
- version/f5 big-ip edge gateway/11.0.0
- version/f5 big-ip edge gateway/11.3.0
- canonical/riverbed steelapp traffic manager
- version/riverbed steelapp traffic manager/10.1.0
- version/riverbed steelapp traffic manager/10.2.4
- version/riverbed steelapp traffic manager/11.0.0
- version/riverbed steelapp traffic manager/11.3.0
- canonical/f5 big-ip link controller
- version/f5 big-ip link controller/10.1.0
- version/f5 big-ip link controller/10.2.4
- version/f5 big-ip link controller/11.0.0
- version/f5 big-ip link controller/11.3.0
- canonical/f5 big-ip policy enforcement manager
- version/f5 big-ip policy enforcement manager/11.3.0
- canonical/f5 big-ip protocol security manager
- version/f5 big-ip protocol security manager/10.1.0
- version/f5 big-ip protocol security manager/10.2.4
- version/f5 big-ip protocol security manager/11.0.0
- version/f5 big-ip protocol security manager/11.3.0
- canonical/exinda wan optimization suite
- version/exinda wan optimization suite/10.1.0
- version/exinda wan optimization suite/10.2.4
- version/exinda wan optimization suite/11.0.0
- version/exinda wan optimization suite/11.3.0
- canonical/f5 big-ip webaccelerator
- version/f5 big-ip webaccelerator/10.1.0
- version/f5 big-ip webaccelerator/10.2.4
- version/f5 big-ip webaccelerator/11.0.0
- version/f5 big-ip webaccelerator/11.3.0
- version/f5 firepass ssl vpn/6.0.0