Information disclosure in F5 Big-Ip Configuration Utility
CVE-2012-2997
XML External Entity (XXE) vulnerability in sam/admin/vpe2/public/php/server.php in F5 BIG-IP 10.0.0 through 10.2.4 and 11.0.0 through 11.2.1 allows remote authenticated users to read arbitrary files via a crafted XML file.
Vulnerability class: Information Disclosure
EPSS: 0.064 (93.0th percentile) — read the EPSS interpretation.
Affected products
- F5 Big-ip_configuration_utility — versions 10.0.0, 10.2.4, 11.0.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cret@cert.org (vdb-entry, x_refsource_XF)
- cret@cert.org (x_refsource_CONFIRM, Vendor Advisory)
- cret@cert.org (x_refsource_OSVDB, vdb-entry)
- cret@cert.org (Exploit, x_refsource_MISC)
- cret@cert.org (vdb-entry, x_refsource_BID)
- cret@cert.org (mailing-list, Exploit, x_refsource_BUGTRAQ)