SQL Injection in F5 Big-Ip Access Policy Manager
CVE-2012-3000
Multiple SQL injection vulnerabilities in sam/admin/reports/php/saveSettings.php in the (1) APM WebGUI in F5 BIG-IP LTM, GTM, ASM, Link Controller, PSM, APM, Edge Gateway, and Analytics and (2) AVR WebGUI in WebAccelerator and WOM 11.2.x before 11.2.0-HF3 and 11.2.x before 11.2.1-HF3 allow remote authenticated users to execute arbitrary SQL commands via the defaultQuery parameter.
Vulnerability class: SQL Injection
EPSS: 0.016 (73.1th percentile) — read the EPSS interpretation.
Affected products
- F5 Big-ip_access_policy_manager — versions 11.1.0, 11.2.0, 11.2.1
- F5 Big-ip_analytics — versions 11.0.0, 11.1.0, 11.2.0
- F5 Big-ip_application_security_manager — versions 11.0.0, 11.1.0, 11.2.0
- F5 Big-ip_edge_gateway — versions 11.0.0, 11.1.0, 11.2.0
- F5 Big-ip_global_traffic_manager — versions 11.0.0, 11.1.0, 11.2.0
- F5 Big-ip_link_controller — versions 11.0.0, 11.1.0, 11.2.0
- F5 Big-ip_local_traffic_manager — versions 11.0.0, 11.1.0, 11.2.0
- F5 Big-ip_protocol_security_module — versions 11.0.0, 11.1.0, 11.2.0
- F5 Big-ip_wan_optimization_manager — versions 11.0.0, 11.1.0, 11.2.0
- F5 Big-ip_webaccelerator — versions 11.0.0, 11.1.0, 11.2.0
Weakness classification (CWE)
References
- cret@cert.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cret@cert.org (x_refsource_OSVDB, vdb-entry)
- cret@cert.org (vdb-entry, x_refsource_BID)
- cret@cert.org (x_refsource_MISC)
- cret@cert.org (vdb-entry, x_refsource_XF)
- cret@cert.org (x_refsource_MISC)
- cret@cert.org (mailing-list, x_refsource_BUGTRAQ)
- cret@cert.org (x_refsource_CONFIRM)