CVEvulnerability

CVE-2018-5540

4.4 MEDIUM Published 2018-07-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-07-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
4.4 MEDIUM — CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-732

Description

On F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.3, 11.6.0-11.6.3.1, or 11.5.1-11.5.6, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.1.0, BIG-IQ Cloud and Orchestration 1.0.0, or F5 iWorkflow 2.1.0-2.3.0 the big3d process does not irrevocably minimize group privileges at start up.

Affected configurations

• f5 big-ip domain name system (>= 11.5.1 <= 11.5.6) • f5 big-ip domain name system (>= 11.6.0 <= 11.6.3.1) • f5 big-ip domain name system (>= 12.1.0 <= 12.1.3.3) • f5 big-ip domain name system (>= 13.0.0 <= 13.0.1) • f5 big-ip global traffic manager (>= 11.5.1 <= 11.5.6) • f5 big-ip global traffic manager (>= 11.6.0 <= 11.6.3.1) • f5 big-ip global traffic manager (>= 12.1.0 <= 12.1.3.3) • f5 big-ip global traffic manager (>= 13.0.0 <= 13.0.1) • f5 enterprise manager 3.1.1 • f5 big-iq centralized management (>= 5.0.0 <= 5.1.0) • f5 big-iq cloud and orchestration 1.0.0 • f5 f5 iworkflow (>= 2.1.0 <= 2.3.0)

Related

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References