Description (CNA)
BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI). Impact: This vulnerability may allow an authenticated attacker with network access to the BIG-IP management interface to escalate privileges by creating administrative accounts on the BIG-IP system. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| F5 / BIG-IP | affected 21.1.0 before 21.1.0.1; affected 21.0.0 before 21.0.0.3; affected 17.5.0 before 17.5.1.8; affected 17.1.0 before 17.1.3.4 |
| F5 / BIG-IQ | affected 8.4.0 before 8.4.2.1 |
CWE
CWE-918
References
ADP enrichment
No English description supplied.
No references supplied.