What is the CVSS score of CVE-2015-4040?

CVE-2015-4040 has a CVSS 2.0 base score of 4.0 (Medium). CVSS vector: AV:N/AC:L/Au:S/C:P/I:N/A:N. EPSS exploitation probability: 6.8%.

Is there a public PoC exploit available for CVE-2015-4040?

Yes, a public proof-of-concept exploit is available for CVE-2015-4040. Prioritise patching immediately. EPSS: 6.8%.

Enterprise Manager CVE-2015-4040

MEDIUM

Path Traversal (CWE-22)

2015-09-17 cve@mitre.org

Path Traversal Enterprise Manager Big Ip Access Policy Manager Big Ip Advanced Firewall Manager Big Ip Analytics Big Ip Application Acceleration Manager Big Ip Application Security Manager Big Ip Edge Gateway Big Ip Global Traffic Manager Big Ip Link Controller Big Ip Local Traffic Manager Big Ip Policy Enforcement Manager Big Ip Protocol Security Module Big Ip Wan Optimization Manager Big Ip Webaccelerator

4.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.0 MEDIUM

AV:N/AC:L/Au:S/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:S/C:P/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Sep 17, 2015 - 16:59 cve.org

MEDIUM 4.0

DescriptionCVE.org

AnalysisAI

Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the web root via unspecified vectors. Affected products include: F5 Enterprise Manager, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager. Version information: before 12.0.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.