CVE-2017-0304: SQL Injection

Published Dec 21, 2017

Updated

A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12.0.0, 12.1.0, 12.1.1, 12.1.2 and 13.0.0 that may allow a copy of the firewall rules to be tampered with and impact the Configuration Utility until there is a resync of the rules. Traffic processing and the live firewall rules in use are not affected.

Affected Software

5 affected components

F5 BIG-IP Advanced Firewall Manager=12.0.0

F5 BIG-IP Advanced Firewall Manager=12.1.0

F5 BIG-IP Advanced Firewall Manager=12.1.1

F5 BIG-IP Advanced Firewall Manager=12.1.2

F5 BIG-IP Advanced Firewall Manager=13.0.0

Event History

Dec 21, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-0304?

CVE-2017-0304 has a medium severity rating due to its potential impact on the configuration of the management UI.

How do I fix CVE-2017-0304?

To fix CVE-2017-0304, update your F5 BIG-IP Advanced Firewall Manager to the latest patched version.

What versions are affected by CVE-2017-0304?

CVE-2017-0304 affects F5 BIG-IP Advanced Firewall Manager versions 12.0.0, 12.1.0, 12.1.1, 12.1.2, and 13.0.0.

What is SQL injection in the context of CVE-2017-0304?

SQL injection in CVE-2017-0304 refers to malicious manipulation of SQL queries through the management UI which can alter firewall rules.

Are there any known exploits for CVE-2017-0304?

As of now, there are no publicly disclosed exploits for CVE-2017-0304, but the vulnerability presents a risk of unauthorized access to management functionality.