CVE-2014-8727: Path Traversal
First published: Mon Nov 17 2014(Updated: )
Multiple directory traversal vulnerabilities in F5 BIG-IP before 10.2.2 allow local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrary files via a .. (dot dot) in the name parameter to (1) tmui/Control/jspmap/tmui/system/archive/properties.jsp or (2) tmui/Control/form.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Riverbed SteelApp Traffic Manager | <=10.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/129084/F5-BIG-IP-10.1.0-Directory-Traversal.html
- http://www.exploit-db.com/exploits/35222
- http://www.securityfocus.com/bid/71063
- http://www.securitytracker.com/id/1031216
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98676
- https://support.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/product/relnote_11_0_0_ltm.html
- https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13109.html
Frequently Asked Questions
What is the severity of CVE-2014-8727?
CVE-2014-8727 is classified as a medium severity vulnerability due to its potential for unauthorized access to sensitive files.
How do I fix CVE-2014-8727?
To fix CVE-2014-8727, upgrade F5 BIG-IP to version 10.2.2 or later, where the vulnerability has been addressed.
Who is affected by CVE-2014-8727?
CVE-2014-8727 affects local users with the Resource Administrator or Administrator role on F5 BIG-IP versions prior to 10.2.2.
What are the impacts of exploiting CVE-2014-8727?
Exploiting CVE-2014-8727 allows attackers to enumerate and delete arbitrary files, potentially leading to data loss or service disruption.
What versions of F5 BIG-IP are vulnerable to CVE-2014-8727?
F5 BIG-IP versions up to 10.2.1 are vulnerable to CVE-2014-8727 and should be updated to a secure version.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/f5
- canonical/riverbed steelapp traffic manager
- version/riverbed steelapp traffic manager/10.2.1