Skip to main content

Big Iq Adc CVE-2015-4637

MEDIUM
DEPRECATED: Code (CWE-17)
2015-07-16 cve@mitre.org
Information Disclosure Big Iq Adc Big Iq Cloud Big Iq Device Big Iq Security
4.3
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:N/A:N
Attack Vector
Network
Attack Complexity
M
Confidentiality
P
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 16, 2015 - 14:59 cve.org
MEDIUM 4.3

DescriptionCVE.org

The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0 before HF2, when configured for LDAP remote authentication and the LDAP server allows anonymous BIND operations, allows remote attackers to obtain an authentication token for arbitrary users by guessing an LDAP user account name.

AnalysisAI

The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0 before HF2, when configured for LDAP remote authentication and the LDAP server allows anonymous BIND. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-17. The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0 before HF2, when configured for LDAP remote authentication and the LDAP server allows anonymous BIND operations, allows remote attackers to obtain an authentication token for arbitrary users by guessing an LDAP user account name. Affected products include: F5 Big-Iq Adc, F5 Big-Iq Cloud, F5 Big-Iq Device, F5 Big-Iq Security.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Big Iq Adc

View all
CVE-2015-3628 CRITICAL POC
9.0 Dec 07

The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.
CVE-2015-4047 HIGH POC
7.8 May 29

racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and

CVE-2015-7394 CRITICAL
9.0 Nov 06

The datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0 before 12.0.0, BIG-IP AAM 1
CVE-2014-0101 HIGH
7.8 Mar 11

The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain

CVE-2015-5058 HIGH
7.8 Aug 24

Memory leak in the virtual server component in F5 Big-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and P

Same weakness CWE-17 – DEPRECATED: Code

View all
CVE-2015-0240 CRITICAL POC
10.0
CVE-2014-9222 CRITICAL POC
10.0
CVE-2014-9707 HIGH POC
7.5
CVE-2015-3292 CRITICAL POC
10.0
CVE-2015-2682 MEDIUM POC
5.0
CVE-2015-4335 CRITICAL POC
10.0
CVE-2015-1728 CRITICAL
9.3
CVE-2014-9296 MEDIUM POC
5.0

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2015-4637 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy