« Volver al listado

CVE-2018-5502

Estado: ModificadaAlta (7.5)—

On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certificate. This vulnerability affects virtual servers associated with Client SSL profile which enables the use of client certificate authentication. Client certificate authentication is not enabled by default in Client SSL profile. There is no control plane exposure.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (13)

F5 — Big-ip Access Policy ManagerF5 — Big-ip Advanced Firewall ManagerF5 — Big-ip AnalyticsF5 — Big-ip Application Acceleration ManagerF5 — Big-ip Application Security ManagerF5 — Big-ip Domain Name SystemF5 — Big-ip Edge GatewayF5 — Big-ip Global Traffic ManagerF5 — Big-ip Link ControllerF5 — Big-ip Local Traffic ManagerF5 — Big-ip Policy Enforcement ManagerF5 — Big-ip WebacceleratorF5 — Big-ip Websafe

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-5502",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "f5sirt@f5.com",
      "affectedData": [
        {
          "vendor": "F5 Networks, Inc.",
          "product": "BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, WebSafe)",
          "versions": [
            {
              "status": "affected",
              "version": "13.0.0 - 13.1.0.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-03-22T18:29:00.510",
  "references": [
    {
      "url": "http://www.securitytracker.com/id/1040561",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "f5sirt@f5.com"
    },
    {
      "url": "https://support.f5.com/csp/article/K43121447",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "f5sirt@f5.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1040561",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.f5.com/csp/article/K43121447",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certificate. This vulnerability affects virtual servers associated with Client SSL profile which enables the use of client certificate authentication. Client certificate authentication is not enabled by default in Client SSL profile. There is no control plane exposure."
    },
    {
      "lang": "es",
      "value": "Desde la versión 13.0.0 hasta la 13.1.0.3 de F5 BIG-IP, los atacantes podrían ser capaces de interrumpir servicios en el sistema BIG-IP con un certificado de cliente maliciosamente manipulado. Esta vulnerabilidad afecta a los servidores virtuales asociados con el perfil Client SSL, que habilita el uso de autenticación de certificados de cliente. Este tipo de autenticación no está habilitado por defecto en el perfil Client SSL. No hay ninguna exposición del plano de control."
    }
  ],
  "lastModified": "2026-06-17T02:00:25.437",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "894DA18C-0B22-45B1-8677-8979F1143216",
              "versionEndExcluding": "13.1.0.4",
              "versionStartIncluding": "13.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "445A66D4-37C1-42A8-A1CA-1D1E2C25E1E2",
              "versionEndExcluding": "13.1.0.4",
              "versionStartIncluding": "13.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE859987-9C3E-42A9-86E2-122B12090A15",
              "versionEndExcluding": "13.1.0.4",
              "versionStartIncluding": "13.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C8DAACD-71E0-4A83-A7ED-14BE366ACD1D",
              "versionEndExcluding": "13.1.0.4",
              "versionStartIncluding": "13.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA630386-C3DC-404E-9011-8DA3CD2F5865",
              "versionEndExcluding": "13.1.0.4",
              "versionStartIncluding": "13.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6170B579-4770-4550-85B7-B784328DC2FF",
              "versionEndIncluding": "13.1.0.4",
              "versionStartIncluding": "13.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8766D2F-4D5D-4C78-B29D-1C5648B732D3",
              "versionEndExcluding": "13.1.0.4",
              "versionStartIncluding": "13.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "717B4A2F-C7E5-45FE-8CD5-8D9E0872B614",
              "versionEndExcluding": "13.1.0.4",
              "versionStartIncluding": "13.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B23C430B-7477-4060-B68A-19B2B441F5EE",
              "versionEndExcluding": "13.1.0.4",
              "versionStartIncluding": "13.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0330565-B391-4121-81EB-601BAEA7BD50",
              "versionEndExcluding": "13.1.0.4",
              "versionStartIncluding": "13.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED65A801-F4BE-4067-903E-8997A13FFEF9",
              "versionEndExcluding": "13.1.0.4",
              "versionStartIncluding": "13.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E231E105-5DBE-4FEC-8DB2-BEB91AC32F1D",
              "versionEndExcluding": "13.1.0.4",
              "versionStartIncluding": "13.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_websafe:1.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E6556BF-A50D-4872-BF81-9397A7ECEC9C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "f5sirt@f5.com"
}