Deskripsi CVE

Multiple directory traversal vulnerabilities in F5 BIG-IP before 10.2.2 allow local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrary files via a .. (dot dot) in the name parameter to (1) tmui/Control/jspmap/tmui/system/archive/properties.jsp or (2) tmui/Control/form.

Informasi CVE

Kelemahan Terkait

CWE-ID	Nama Kelemahan	Sumber
CWE-22	Improper Limitation of a Pathname to a Restricted Directory The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Metrik

Metrik	Skor	Tingkat keparahan	CVSS Vektor	Sumber
V2	6.2		AV:L/AC:L/Au:S/C:N/I:C/A:C	nvd@nist.gov

EPSS

EPSS adalah model penilaian yang memprediksi kemungkinan suatu kerentanan dieksploitasi.

Skor EPSS

Model EPSS menghasilkan skor probabilitas antara 0 dan 1 (0 hingga 100%). Semakin tinggi skor, semakin besar probabilitas bahwa suatu kerentanan akan dieksploitasi.

Persentil EPSS

Persentil digunakan untuk meranking CVE berdasarkan skor EPSS mereka. Misalnya, CVE di persentil ke-95 berdasarkan skor EPSS-nya lebih mungkin dieksploitasi daripada 95% CVE lainnya. Dengan demikian, persentil digunakan untuk membandingkan skor EPSS suatu CVE dengan CVE lainnya.

EPSS First.org

Informasi eksploitasi

Exploit Database EDB-ID : 35222

Tanggal publikasi : 2014-11-12 23h00 +00:00
Penulis : Anastasios Monachos
Terverifikasi EDB : No

Produk yang Disebutkan

Konfigurasi 0

F5>>Big-ip_local_traffic_manager >> Version Hingga (termasuk) 10.2.1

Referensi

http://www.securitytracker.com/id/1031216
Tags : vdb-entry, x_refsource_SECTRACK

http://packetstormsecurity.com/files/129084/F5-BIG-IP-10.1.0-Directory-Traversal.html
Tags : x_refsource_MISC

https://exchange.xforce.ibmcloud.com/vulnerabilities/98676
Tags : vdb-entry, x_refsource_XF

http://www.securityfocus.com/bid/71063
Tags : vdb-entry, x_refsource_BID

http://www.exploit-db.com/exploits/35222
Tags : exploit, x_refsource_EXPLOIT-DB

https://support.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/product/relnote_11_0_0_ltm.html
Tags : x_refsource_CONFIRM

https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13109.html
Tags : x_refsource_CONFIRM

Tanggal	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	2.12%	–	–
2022-03-20	–	–	2.12%	–	–
2022-04-03	–	–	2.12%	–	–
2022-06-19	–	–	2.12%	–	–
2022-11-13	–	–	2.12%	–	–
2022-11-20	–	–	2.12%	–	–
2022-12-25	–	–	2.12%	–	–
2023-01-01	–	–	2.12%	–	–
2023-02-19	–	–	2.12%	–	–
2023-03-12	–	–	–	0.06%	–
2024-02-11	–	–	–	0.06%	–
2024-03-03	–	–	–	0.06%	–
2024-04-14	–	–	–	0.06%	–
2024-06-02	–	–	–	0.06%	–
2024-08-25	–	–	–	0.06%	–
2024-12-08	–	–	–	0.06%	–
2025-01-19	–	–	–	0.06%	–
2025-02-16	–	–	–	0.06%	–
2025-02-16	–	–	–	0.06%	–
2025-03-18	–	–	–	–	0.14%
2025-03-30	–	–	–	–	0.16%
2025-04-15	–	–	–	–	0.16%
2025-05-01	–	–	–	–	0.16%
2025-05-04	–	–	–	–	0.16%
2025-05-21	–	–	–	–	0.16%
2025-05-25	–	–	–	–	0.16%
2025-06-01	–	–	–	–	0.16%
2025-06-04	–	–	–	–	0.16%
2025-11-18	–	–	–	–	0.16%
2025-11-21	–	–	–	–	0.16%
2026-02-22	–	–	–	–	0.16%
2026-04-05	–	–	–	–	0.16%
2026-04-12	–	–	–	–	0.16%

Tanggal	Persentil
2022-02-06	57%
2022-03-20	58%
2022-04-03	78%
2022-06-19	79%
2022-11-13	8%
2022-11-20	79%
2022-12-25	8%
2023-01-01	79%
2023-02-19	8%
2023-03-12	25%
2024-02-11	24%
2024-03-03	25%
2024-04-14	26%
2024-06-02	27%
2024-08-25	28%
2024-12-08	29%
2025-01-19	29%
2025-02-16	3%
2025-02-16	3%
2025-03-18	31%
2025-03-30	34%
2025-04-15	38%
2025-05-01	39%
2025-05-04	38%
2025-05-21	39%
2025-05-25	38%
2025-06-01	39%
2025-06-04	38%
2025-11-18	32%
2025-11-21	38%
2026-02-22	37%
2026-04-05	38%
2026-04-12	37%

CVE-2014-8727 : Detail

CVE-2014-8727