CVE-2015-8022
First published: Fri Aug 19 2016(Updated: )
The Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, and Link Controller 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP AAM 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP AFM and PEM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP Edge Gateway, WebAccelerator, and WOM 11.x before 11.2.1 HF16 and 11.3.0; and BIG-IP PSM 11.x before 11.2.1 HF16, 11.3.x, and 11.4.x before 11.4.1 HF10 allows remote authenticated users with certain permissions to gain privileges by leveraging an Access Policy Manager customization configuration section that allows file uploads.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Riverbed SteelApp Traffic Manager | =11.0.0 | |
| Riverbed SteelApp Traffic Manager | =11.1.0 | |
| Riverbed SteelApp Traffic Manager | =11.2.0 | |
| Riverbed SteelApp Traffic Manager | =11.2.1 | |
| Riverbed SteelApp Traffic Manager | =11.3.0 | |
| Riverbed SteelApp Traffic Manager | =11.4.0 | |
| Riverbed SteelApp Traffic Manager | =11.4.1 | |
| Riverbed SteelApp Traffic Manager | =11.5.0 | |
| Riverbed SteelApp Traffic Manager | =11.5.1 | |
| Riverbed SteelApp Traffic Manager | =11.5.2 | |
| Riverbed SteelApp Traffic Manager | =11.5.3 | |
| Riverbed SteelApp Traffic Manager | =11.6.0 | |
| Riverbed SteelApp Traffic Manager | =11.0.0 | |
| Riverbed SteelApp Traffic Manager | =11.1.0 | |
| Riverbed SteelApp Traffic Manager | =11.2.0 | |
| Riverbed SteelApp Traffic Manager | =11.2.1 | |
| Riverbed SteelApp Traffic Manager | =11.3.0 | |
| Riverbed SteelApp Traffic Manager | =11.4.0 | |
| Riverbed SteelApp Traffic Manager | =11.4.1 | |
| Riverbed SteelApp Traffic Manager | =11.5.0 | |
| Riverbed SteelApp Traffic Manager | =11.5.1 | |
| Riverbed SteelApp Traffic Manager | =11.5.2 | |
| Riverbed SteelApp Traffic Manager | =11.5.3 | |
| Riverbed SteelApp Traffic Manager | =11.6.0 | |
| F5 BIG-IP WebAccelerator | =11.0.0 | |
| F5 BIG-IP WebAccelerator | =11.1.0 | |
| F5 BIG-IP WebAccelerator | =11.2.0 | |
| F5 BIG-IP WebAccelerator | =11.2.1 | |
| F5 BIG-IP WebAccelerator | =11.3.0 | |
| F5 BIG-IP Policy Enforcement Manager | =11.3.0 | |
| F5 BIG-IP Policy Enforcement Manager | =11.4.0 | |
| F5 BIG-IP Policy Enforcement Manager | =11.4.1 | |
| F5 BIG-IP Policy Enforcement Manager | =11.5.0 | |
| F5 BIG-IP Policy Enforcement Manager | =11.5.1 | |
| F5 BIG-IP Policy Enforcement Manager | =11.5.2 | |
| F5 BIG-IP Policy Enforcement Manager | =11.5.3 | |
| F5 BIG-IP Policy Enforcement Manager | =11.6.0 | |
| F5 BIG-IP Advanced Firewall Manager | =11.3.0 | |
| F5 BIG-IP Advanced Firewall Manager | =11.4.0 | |
| F5 BIG-IP Advanced Firewall Manager | =11.4.1 | |
| F5 BIG-IP Advanced Firewall Manager | =11.5.0 | |
| F5 BIG-IP Advanced Firewall Manager | =11.5.1 | |
| F5 BIG-IP Advanced Firewall Manager | =11.5.2 | |
| F5 BIG-IP Advanced Firewall Manager | =11.5.3 | |
| F5 BIG-IP Advanced Firewall Manager | =11.6.0 | |
| F5 Access Policy Manager | =11.0.0 | |
| F5 Access Policy Manager | =11.1.0 | |
| F5 Access Policy Manager | =11.2.0 | |
| F5 Access Policy Manager | =11.2.1 | |
| F5 Access Policy Manager | =11.3.0 | |
| F5 Access Policy Manager | =11.4.0 | |
| F5 Access Policy Manager | =11.4.1 | |
| F5 Access Policy Manager | =11.5.0 | |
| F5 Access Policy Manager | =11.5.1 | |
| F5 Access Policy Manager | =11.5.2 | |
| F5 Access Policy Manager | =11.5.3 | |
| F5 Access Policy Manager | =11.6.0 | |
| F5 BIG-IP Analytics | =11.0.0 | |
| F5 BIG-IP Analytics | =11.1.0 | |
| F5 BIG-IP Analytics | =11.2.0 | |
| F5 BIG-IP Analytics | =11.2.1 | |
| F5 BIG-IP Analytics | =11.3.0 | |
| F5 BIG-IP Analytics | =11.4.0 | |
| F5 BIG-IP Analytics | =11.4.1 | |
| F5 BIG-IP Analytics | =11.5.0 | |
| F5 BIG-IP Analytics | =11.5.1 | |
| F5 BIG-IP Analytics | =11.5.2 | |
| F5 BIG-IP Analytics | =11.5.3 | |
| F5 BIG-IP Analytics | =11.6.0 | |
| Exinda WAN Optimization Suite | =11.0.0 | |
| Exinda WAN Optimization Suite | =11.1.0 | |
| Exinda WAN Optimization Suite | =11.2.0 | |
| Exinda WAN Optimization Suite | =11.2.1 | |
| Exinda WAN Optimization Suite | =11.3.0 | |
| F5 BIG-IP Link Controller | =11.0.0 | |
| F5 BIG-IP Link Controller | =11.1.0 | |
| F5 BIG-IP Link Controller | =11.2.0 | |
| F5 BIG-IP Link Controller | =11.2.1 | |
| F5 BIG-IP Link Controller | =11.3.0 | |
| F5 BIG-IP Link Controller | =11.4.0 | |
| F5 BIG-IP Link Controller | =11.4.1 | |
| F5 BIG-IP Link Controller | =11.5.0 | |
| F5 BIG-IP Link Controller | =11.5.1 | |
| F5 BIG-IP Link Controller | =11.5.2 | |
| F5 BIG-IP Link Controller | =11.5.3 | |
| F5 BIG-IP Link Controller | =11.6.0 | |
| F5 BIG-IP Edge Gateway | =11.0.0 | |
| F5 BIG-IP Edge Gateway | =11.1.0 | |
| F5 BIG-IP Edge Gateway | =11.2.0 | |
| F5 BIG-IP Edge Gateway | =11.2.1 | |
| F5 BIG-IP Edge Gateway | =11.3.0 | |
| F5 Application Security Manager | =11.0.0 | |
| F5 Application Security Manager | =11.1.0 | |
| F5 Application Security Manager | =11.2.0 | |
| F5 Application Security Manager | =11.2.1 | |
| F5 Application Security Manager | =11.3.0 | |
| F5 Application Security Manager | =11.4.0 | |
| F5 Application Security Manager | =11.4.1 | |
| F5 Application Security Manager | =11.5.0 | |
| F5 Application Security Manager | =11.5.1 | |
| F5 Application Security Manager | =11.5.2 | |
| F5 Application Security Manager | =11.5.3 | |
| F5 Application Security Manager | =11.6.0 | |
| F5 BIG-IP Application Acceleration Manager | =11.4.0 | |
| F5 BIG-IP Application Acceleration Manager | =11.4.1 | |
| F5 BIG-IP Application Acceleration Manager | =11.5.0 | |
| F5 BIG-IP Application Acceleration Manager | =11.5.1 | |
| F5 BIG-IP Application Acceleration Manager | =11.5.2 | |
| F5 BIG-IP Application Acceleration Manager | =11.5.3 | |
| F5 BIG-IP Application Acceleration Manager | =11.6.0 | |
| F5 WebSafe | =11.6.0 | |
| F5 BIG-IP Protocol Security Manager | =11.0.0 | |
| F5 BIG-IP Protocol Security Manager | =11.1.0 | |
| F5 BIG-IP Protocol Security Manager | =11.2.0 | |
| F5 BIG-IP Protocol Security Manager | =11.2.1 | |
| F5 BIG-IP Protocol Security Manager | =11.3.0 | |
| F5 BIG-IP Protocol Security Manager | =11.4.0 | |
| F5 BIG-IP Protocol Security Manager | =11.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2015-8022?
CVE-2015-8022 has been rated as high severity due to the potential for unauthorized access and modification of sensitive configurations.
How do I fix CVE-2015-8022?
To mitigate CVE-2015-8022, upgrade to the appropriate patched version for your F5 BIG-IP system as specified in the vendor's guidance.
Which F5 BIG-IP versions are affected by CVE-2015-8022?
CVE-2015-8022 affects F5 BIG-IP versions including 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1.
What types of products are impacted by CVE-2015-8022?
CVE-2015-8022 impacts F5 products including BIG-IP LTM, APM, ASM, GTM, Analytics, and Link Controller.
Is there a workaround for CVE-2015-8022?
There are no official workarounds for CVE-2015-8022; upgrading to the patched versions is the recommended solution.
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- vendor/f5
- canonical/riverbed steelapp traffic manager
- version/riverbed steelapp traffic manager/11.0.0
- version/riverbed steelapp traffic manager/11.1.0
- version/riverbed steelapp traffic manager/11.2.0
- version/riverbed steelapp traffic manager/11.2.1
- version/riverbed steelapp traffic manager/11.3.0
- version/riverbed steelapp traffic manager/11.4.0
- version/riverbed steelapp traffic manager/11.4.1
- version/riverbed steelapp traffic manager/11.5.0
- version/riverbed steelapp traffic manager/11.5.1
- version/riverbed steelapp traffic manager/11.5.2
- version/riverbed steelapp traffic manager/11.5.3
- version/riverbed steelapp traffic manager/11.6.0
- canonical/f5 big-ip webaccelerator
- version/f5 big-ip webaccelerator/11.0.0
- version/f5 big-ip webaccelerator/11.1.0
- version/f5 big-ip webaccelerator/11.2.0
- version/f5 big-ip webaccelerator/11.2.1
- version/f5 big-ip webaccelerator/11.3.0
- canonical/f5 big-ip policy enforcement manager
- version/f5 big-ip policy enforcement manager/11.3.0
- version/f5 big-ip policy enforcement manager/11.4.0
- version/f5 big-ip policy enforcement manager/11.4.1
- version/f5 big-ip policy enforcement manager/11.5.0
- version/f5 big-ip policy enforcement manager/11.5.1
- version/f5 big-ip policy enforcement manager/11.5.2
- version/f5 big-ip policy enforcement manager/11.5.3
- version/f5 big-ip policy enforcement manager/11.6.0
- canonical/f5 big-ip advanced firewall manager
- version/f5 big-ip advanced firewall manager/11.3.0
- version/f5 big-ip advanced firewall manager/11.4.0
- version/f5 big-ip advanced firewall manager/11.4.1
- version/f5 big-ip advanced firewall manager/11.5.0
- version/f5 big-ip advanced firewall manager/11.5.1
- version/f5 big-ip advanced firewall manager/11.5.2
- version/f5 big-ip advanced firewall manager/11.5.3
- version/f5 big-ip advanced firewall manager/11.6.0
- canonical/f5 access policy manager
- version/f5 access policy manager/11.0.0
- version/f5 access policy manager/11.1.0
- version/f5 access policy manager/11.2.0
- version/f5 access policy manager/11.2.1
- version/f5 access policy manager/11.3.0
- version/f5 access policy manager/11.4.0
- version/f5 access policy manager/11.4.1
- version/f5 access policy manager/11.5.0
- version/f5 access policy manager/11.5.1
- version/f5 access policy manager/11.5.2
- version/f5 access policy manager/11.5.3
- version/f5 access policy manager/11.6.0
- canonical/f5 big-ip analytics
- version/f5 big-ip analytics/11.0.0
- version/f5 big-ip analytics/11.1.0
- version/f5 big-ip analytics/11.2.0
- version/f5 big-ip analytics/11.2.1
- version/f5 big-ip analytics/11.3.0
- version/f5 big-ip analytics/11.4.0
- version/f5 big-ip analytics/11.4.1
- version/f5 big-ip analytics/11.5.0
- version/f5 big-ip analytics/11.5.1
- version/f5 big-ip analytics/11.5.2
- version/f5 big-ip analytics/11.5.3
- version/f5 big-ip analytics/11.6.0
- canonical/exinda wan optimization suite
- version/exinda wan optimization suite/11.0.0
- version/exinda wan optimization suite/11.1.0
- version/exinda wan optimization suite/11.2.0
- version/exinda wan optimization suite/11.2.1
- version/exinda wan optimization suite/11.3.0
- canonical/f5 big-ip link controller
- version/f5 big-ip link controller/11.0.0
- version/f5 big-ip link controller/11.1.0
- version/f5 big-ip link controller/11.2.0
- version/f5 big-ip link controller/11.2.1
- version/f5 big-ip link controller/11.3.0
- version/f5 big-ip link controller/11.4.0
- version/f5 big-ip link controller/11.4.1
- version/f5 big-ip link controller/11.5.0
- version/f5 big-ip link controller/11.5.1
- version/f5 big-ip link controller/11.5.2
- version/f5 big-ip link controller/11.5.3
- version/f5 big-ip link controller/11.6.0
- canonical/f5 big-ip edge gateway
- version/f5 big-ip edge gateway/11.0.0
- version/f5 big-ip edge gateway/11.1.0
- version/f5 big-ip edge gateway/11.2.0
- version/f5 big-ip edge gateway/11.2.1
- version/f5 big-ip edge gateway/11.3.0
- canonical/f5 application security manager
- version/f5 application security manager/11.0.0
- version/f5 application security manager/11.1.0
- version/f5 application security manager/11.2.0
- version/f5 application security manager/11.2.1
- version/f5 application security manager/11.3.0
- version/f5 application security manager/11.4.0
- version/f5 application security manager/11.4.1
- version/f5 application security manager/11.5.0
- version/f5 application security manager/11.5.1
- version/f5 application security manager/11.5.2
- version/f5 application security manager/11.5.3
- version/f5 application security manager/11.6.0
- canonical/f5 big-ip application acceleration manager
- version/f5 big-ip application acceleration manager/11.4.0
- version/f5 big-ip application acceleration manager/11.4.1
- version/f5 big-ip application acceleration manager/11.5.0
- version/f5 big-ip application acceleration manager/11.5.1
- version/f5 big-ip application acceleration manager/11.5.2
- version/f5 big-ip application acceleration manager/11.5.3
- version/f5 big-ip application acceleration manager/11.6.0
- canonical/f5 websafe
- version/f5 websafe/11.6.0
- canonical/f5 big-ip protocol security manager
- version/f5 big-ip protocol security manager/11.0.0
- version/f5 big-ip protocol security manager/11.1.0
- version/f5 big-ip protocol security manager/11.2.0
- version/f5 big-ip protocol security manager/11.2.1
- version/f5 big-ip protocol security manager/11.3.0
- version/f5 big-ip protocol security manager/11.4.0
- version/f5 big-ip protocol security manager/11.4.1