CVE-2017-0301: High severity f5 access policy manager vulnerability

Published Dec 21, 2017

Updated

In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources, however the application resources and backend servers are unaffected.

Affected Software

11 affected components

F5 BIG-IP Access Policy Manager=11.5.0

F5 BIG-IP Access Policy Manager=11.5.1

F5 BIG-IP Access Policy Manager=11.5.2

F5 BIG-IP Access Policy Manager=11.5.3

F5 BIG-IP Access Policy Manager=11.5.4

F5 BIG-IP Access Policy Manager=11.6.0

F5 BIG-IP Access Policy Manager=11.6.1

F5 BIG-IP Access Policy Manager=12.0.0

F5 BIG-IP Access Policy Manager=12.1.0

F5 BIG-IP Access Policy Manager=12.1.1

F5 BIG-IP Access Policy Manager=12.1.2

Event History

Dec 21, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-0301?

CVE-2017-0301 has been classified with high severity due to the potential access to internal resources without proper authorization.

How do I fix CVE-2017-0301?

To fix CVE-2017-0301, it is recommended to upgrade to a patched version of F5 BIG-IP APM that addresses this vulnerability.

What versions of F5 BIG-IP APM are affected by CVE-2017-0301?

CVE-2017-0301 affects F5 BIG-IP APM versions 11.5.0 through 12.1.2.

What types of attacks can exploit CVE-2017-0301?

CVE-2017-0301 can be exploited to gain unauthorized access to internal BIG-IP APM resources under certain conditions.

Is there a workaround for CVE-2017-0301?

Currently, the only recommended resolution for CVE-2017-0301 is to apply the available patches or updates.