Vulnerability Details : CVE-2014-6032
Multiple XML External Entity (XXE) vulnerabilities in the Configuration utility in F5 BIG-IP LTM, ASM, GTM, and Link Controller 11.0 through 11.6.0 and 10.0.0 through 10.2.4, AAM 11.4.0 through 11.6.0, ARM 11.3.0 through 11.6.0, Analytics 11.0.0 through 11.6.0, APM and Edge Gateway 11.0.0 through 11.6.0 and 10.1.0 through 10.2.4, PEM 11.3.0 through 11.6.0, PSM 11.0.0 through 11.4.1 and 10.0.0 through 10.2.4, and WOM 11.0.0 through 11.3.0 and 10.0.0 through 10.2.4 and Enterprise Manager 3.0.0 through 3.1.1 and 2.1.0 through 2.3.0 allow remote authenticated users to read arbitrary files and cause a denial of service via a crafted request, as demonstrated using (1) viewList or (2) deal elements.
Vulnerability category: XML external entity (XXE) injectionDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2014-6032
Probability of exploitation activity in the next 30 days: 0.71%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 78 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-6032
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
5.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:P |
8.0
|
4.9
|
NIST |
References for CVE-2014-6032
-
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-6033/
cve-2014-6033 - Portcullis
-
http://packetstormsecurity.com/files/128915/F5-Big-IP-11.3.0.39.0-XML-External-Entity-Injection-1.html
F5 Big-IP 11.3.0.39.0 XML External Entity Injection #1 ≈ Packet StormExploit
-
https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15605.html
Vendor Advisory
-
http://seclists.org/fulldisclosure/2014/Oct/129
Full Disclosure: CVE-2014-6033 - XML External Entity Injection in F5 Networks Big-IP
-
http://seclists.org/fulldisclosure/2014/Oct/130
Full Disclosure: Re: CVE-2014-6032 - XML External Entity Injection in F5 Networks Big-IP
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/98402
F5 BIG-IP XML information disclosure CVE-2014-6032 Vulnerability Report
-
http://seclists.org/fulldisclosure/2014/Oct/128
Full Disclosure: CVE-2014-6032 - XML External Entity Injection in F5 Networks Big-IP
-
http://www.securitytracker.com/id/1031145
F5 BIG-IP External Entity Processing Flaw in Configuration Utility Lets Remote Authenticated Users Obtain Information and Deny Service - SecurityTracker
-
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-6032/
cve-2014-6032 - Portcullis
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/98403
F5 BIG-IP XML information disclosure CVE-2014-6033 Vulnerability Report
-
http://www.securityfocus.com/bid/70834
F5 Networks BIG-IP CVE-2014-6032 XML External Entity Injection VulnerabilityExploit
-
http://www.securitytracker.com/id/1031144
F5 Enterprise Manager XML External Entity Processing Flaw in Configuration Utility Lets Remote Authenticated Users Obtain Information and Deny Service - SecurityTracker
Products affected by CVE-2014-6032
- cpe:2.3:a:f5:big-ip_local_traffic_manager:10.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:10.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:10.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:10.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:10.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:10.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:10.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:10.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:10.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:10.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:10.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:10.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:10.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:10.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:10.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:10.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:enterprise_manager:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:enterprise_manager:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:enterprise_manager:3.1.0:*:*:*:*:*:*:*
- cpe:2.3:h:f5:enterprise_manager:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:h:f5:enterprise_manager:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:h:f5:enterprise_manager:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_webaccelerator:11.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_webaccelerator:11.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_webaccelerator:11.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_webaccelerator:11.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_webaccelerator:10.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_webaccelerator:10.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_webaccelerator:10.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_webaccelerator:10.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_webaccelerator:10.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_webaccelerator:11.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_webaccelerator:10.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_webaccelerator:10.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_edge_gateway:11.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_edge_gateway:11.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_edge_gateway:11.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_edge_gateway:11.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_edge_gateway:10.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_edge_gateway:10.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_edge_gateway:10.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_edge_gateway:10.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_edge_gateway:10.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_edge_gateway:11.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_edge_gateway:10.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:10.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:11.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:11.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:11.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:11.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:11.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:10.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:10.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:10.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:10.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:10.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:10.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:10.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:10.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.0:*:*:*:*:*:*:*