CVE-2018-5547

Severity Score

7.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to establish network access. This feature displays a certificate user interface dialog box which contains the link to the certificate policy. By clicking on the link, unprivileged users can open additional dialog boxes and get access to the local machine windows explorer which can be used to get administrator privilege. Windows Logon Integration is vulnerable when the APM client is installed by an administrator on a user machine. Users accessing the local machine can get administrator privileges

La característica Windows Logon Integration del cliente F5 BIG-IP APM en versiones anteriores a la 7.1.7.1 para Windows utiliza de forma predeterminada el modo de inicio de sesión heredado, que utiliza una cuenta SYSTEM para establecer el acceso a la red. Esta función muestra un cuadro de diálogo de la interfaz de usuario del certificado que contiene el enlace a la política de certificados. Al hacer clic en el enlace, los usuarios sin privilegios pueden abrir cuadros de diálogo adicionales y obtener acceso al explorador de ventanas del equipo local, que se puede utilizar para obtener privilegios de administrador. Windows Logon Integration es vulnerable cuando un administrador instala el cliente APM en un equipo de usuario. Los usuarios que accedan a la máquina local pueden obtener privilegios de administrador

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-01-12 CVE Reserved
2018-08-17 CVE Published
2023-08-11 EPSS Updated
2024-09-17 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-862: Missing Authorization

CAPEC

References (3)

URL	Tag	Source
http://www.securitytracker.com/id/1041511	Third Party Advisory
https://support.f5.com/csp/article/K10015187?utm_source=f5support&amp%3Butm_medium=RSS	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://support.f5.com/csp/article/K10015187	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
F5 Search vendor "F5"		Big-ip Access Policy Manager Client Search vendor "F5" for product "Big-ip Access Policy Manager Client"				7.1.6 Search vendor "F5" for product "Big-ip Access Policy Manager Client" and version "7.1.6"		-		Affected
F5 Search vendor "F5"		Big-ip Access Policy Manager Client Search vendor "F5" for product "Big-ip Access Policy Manager Client"				7.1.6.1 Search vendor "F5" for product "Big-ip Access Policy Manager Client" and version "7.1.6.1"		-		Affected
F5 Search vendor "F5"		Big-ip Access Policy Manager Client Search vendor "F5" for product "Big-ip Access Policy Manager Client"				7.1.7 Search vendor "F5" for product "Big-ip Access Policy Manager Client" and version "7.1.7"		-		Affected