Detections
Analytics
F5 Networks BIG-IP : XML Entity Injection vulnerabilities (K15605)
critical Nessus Plugin ID 83502
Language:
Synopsis
The remote device is missing a vendor-supplied security patch.Description
XML Entity Injection vulnerabilities have been found in the BIG-IP Configuration utility and the Enterprise Manager Configuration utility. The vulnerabilities are available to authenticated users only. (CVE-2014-6032 and CVE-2014-6033)Solution
Upgrade to one of the non-vulnerable versions listed in the F5 Solution K15605.See Also
Plugin Details
Severity: Critical
ID: 83502
File Name: f5_bigip_SOL15605.nasl
Version: 2.12
Type: Local
Published: 5/18/2015
Updated: 10/21/2026
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
CVSS v2
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:P
CVSS Score Source: CVE-2014-6032
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 9.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Temporal Vector: CVSS:3.0/E:X/RL:U/RC:C
CVSS Score Source: CVE-2014-6033
Vulnerability Information
CPE: cpe:/a:f5:big-ip_access_policy_manager, cpe:/a:f5:big-ip_advanced_firewall_manager, cpe:/a:f5:big-ip_application_acceleration_manager, cpe:/a:f5:big-ip_application_security_manager, cpe:/a:f5:big-ip_application_visibility_and_reporting, cpe:/a:f5:big-ip_global_traffic_manager, cpe:/a:f5:big-ip_link_controller, cpe:/a:f5:big-ip_local_traffic_manager, cpe:/a:f5:big-ip_policy_enforcement_manager, cpe:/a:f5:big-ip_wan_optimization_manager, cpe:/a:f5:big-ip_webaccelerator, cpe:/h:f5:big-ip, cpe:/h:f5:big-ip_protocol_security_manager
Required KB Items: Host/local_checks_enabled, Settings/ParanoidReport, Host/BIG-IP/hotfix, Host/BIG-IP/modules, Host/BIG-IP/version
Exploit Ease: No known exploits are available
Patch Publication Date: 9/17/2014
Vulnerability Publication Date: 11/1/2014
Reference Information
CVE: CVE-2014-6032, CVE-2014-6033