CVE-2012-3000

F5 BIG-IP - Authenticated SQL Injection via defaultQuery Parameter

Title source: llm
STIX 2.1

Description

Multiple SQL injection vulnerabilities in sam/admin/reports/php/saveSettings.php in the (1) APM WebGUI in F5 BIG-IP LTM, GTM, ASM, Link Controller, PSM, APM, Edge Gateway, and Analytics and (2) AVR WebGUI in WebAccelerator and WOM 11.2.x before 11.2.0-HF3 and 11.2.x before 11.2.1-HF3 allow remote authenticated users to execute arbitrary SQL commands via the defaultQuery parameter.

References (8)

Core 8
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/51867
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/89446
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/57500
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/81457
Third Party Advisory mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2013-01/0094.html

Scores

EPSS 0.0128
EPSS Percentile 79.8%

Details

CWE
CWE-89
Status published
Products (40)
f5/big-ip_access_policy_manager 11.1.0 (2 CPE variants)
f5/big-ip_access_policy_manager 11.2.0 (2 CPE variants)
f5/big-ip_access_policy_manager 11.2.1 (2 CPE variants)
f5/big-ip_access_policy_manager 11.0.0
f5/big-ip_analytics 11.0.0
f5/big-ip_analytics 11.1.0
f5/big-ip_analytics 11.2.0
f5/big-ip_analytics 11.2.1
f5/big-ip_application_security_manager 11.0.0 (2 CPE variants)
f5/big-ip_application_security_manager 11.1.0 (2 CPE variants)
... and 30 more
Published Jan 30, 2014
Tracked Since Feb 18, 2026