CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 9.0
CWE Name:  Permissions Privileges and Access Controls
Summary: the icontrol api in f5 big-ip ltm, afm, analytics, apm, asm, link controller, and pem 11.3.0 before 11.5.3 hf2 and 11.6.0 before 11.6.0 hf6, big-ip aam 11.4.0 before 11.5.3 hf2 and 11.6.0 before 11.6.0 hf6, big-ip edge gateway, webaccelerator, and wom 11.3.0, big-ip gtm 11.3.0 before 11.6.0 hf6, big-ip psm 11.3.0 through 11.4.1, enterprise manager 3.1.0 through 3.1.1, big-iq cloud and security 4.0.0 through 4.5.0, big-iq device 4.2.0 through 4.5.0, and big-iq adc 4.5.0 allows remote authenticated users with the "resource administrator" role to gain privileges via an icall (1) script or (2) handler in a soap request to icontrol/icontrolportal.cgi.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2015-12-07
Last Modified Date: 2019-06-06